An update for spamassassin is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The SpamAssassin tool provides a way to reduce unsolicited commercial email (spam) from incoming email.

Security Fix(es) :

* spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and result in denial of service (CVE-2017-15705)

* spamassassin: Local user code injection in the meta rule syntax (CVE-2018-11781)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in the way a local user on the SpamAssassin server could inject code in the meta rule syntax. This could cause the arbitrary code execution on the server when these rules are being processed.(CVE-2018-11781)

A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.(CVE-2018-11780)

A flaw was found in the way SpamAssassin processes HTML email containing unclosed HTML tags. A carefully crafted mail message could cause SpamAssassin to consume significant resources. If a large number of these messages are sent, a denial of service could occur potentially delaying or preventing the delivery of email.(CVE-2017-15705)

Fixed some small bugs in the previous package: Initial rules now have the correct version, sought channel config is dropped (since it doesn't exist anymore) and build / runtime deps adjusted. 

----

Update to 3.4.2. Fixes CVE-2017-15705, CVE-2018-11780 and CVE-2018-11781 along with many other bugfixes and improvements. See https://www.mail-archive.com/announce@apache.org/msg04823.html for more information.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3811-1 advisory.

    It was discovered that SpamAssassin incorrectly handled certain unclosed tags in emails. A remote attacker     could possibly use this issue to cause a denial of service. (CVE-2017-15705)

    It was discovered that SpamAssassin incorrectly handled the PDFInfo plugin. A remote attacker could     possibly use this issue to execute arbitrary code. (CVE-2018-11780)

    It was discovered that SpamAssassin incorrectly handled meta rule syntax. A local attacker could possibly     use this issue to execute arbitrary code. (CVE-2018-11781)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has spamassassin packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the way a local user on the     SpamAssassin server could inject code in the meta rule     syntax. This could cause the arbitrary code execution on     the server when these rules are being processed.
    (CVE-2018-11781)

  - A flaw was found in the way SpamAssassin processes HTML     email containing unclosed HTML tags. A carefully crafted     mail message could cause SpamAssassin to consume     significant resources. If a large number of these     messages are sent, a denial of service could occur     potentially delaying or preventing the delivery of     email. (CVE-2017-15705)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the spamassassin package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A denial of service vulnerability was identified that     exists in Apache SpamAssassin before 3.4.2. The     vulnerability arises with certain unclosed tags in     emails that cause markup to be handled incorrectly     leading to scan timeouts. In Apache SpamAssassin, using     HTML::Parser, we setup an object and hook into the     begin and end tag event handlers In both cases, the     'open' event is immediately followed by a 'close' event
    - even if the tag *does not* close in the HTML being     parsed. Because of this, we are missing the 'text'     event to deal with the object normally. This can cause     carefully crafted emails that might take more scan time     than expected leading to a Denial of Service. The issue     is possibly a bug or design decision in HTML::Parser     that specifically impacts the way Apache SpamAssassin     uses the module with poorly formed html. The exploit     has been seen in the wild but not believed to have been     purposefully part of a Denial of Service attempt. We     are concerned that there may be attempts to abuse the     vulnerability in the future.(CVE-2017-15705)

  - Apache SpamAssassin 3.4.2 fixes a local user code     injection in the meta rule syntax.(CVE-2018-11781)

  - In Apache SpamAssassin before 3.4.3, a message can be     crafted in a way to use excessive resources. Upgrading     to SA 3.4.3 as soon as possible is the recommended fix     but details will not be shared     publicly.(CVE-2019-12420)

  - A command execution issue was found in Apache     SpamAssassin prior to 3.4.3. Carefully crafted     nefarious Configuration (.cf) files can be configured     to run system commands similar to CVE-2018-11805. This     issue is less stealthy and attempts to exploit the     issue will throw warnings. Thanks to Damian Lukowski at     credativ for reporting the issue ethically. With this     bug unpatched, exploits can be injected in a number of     scenarios though doing so remotely is difficult. In     addition to upgrading to SA 3.4.4, we again recommend     that users should only use update channels or 3rd party     .cf files from trusted places.(CVE-2020-1931)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The     vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly     leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the     begin and end tag event handlers In both cases, the open event is immediately followed by a close     event - even if the tag *does not* close in the HTML being parsed. Because of this, we are missing the     text event to deal with the object normally. This can cause carefully crafted emails that might take     more scan time than expected leading to a Denial of Service. The issue is possibly a bug or design     decision in HTML::Parser that specifically impacts the way Apache SpamAssassin uses the module with poorly     formed html. The exploit has been seen in the wild but not believed to have been purposefully part of a     Denial of Service attempt. We are concerned that there may be attempts to abuse the vulnerability in the     future. (CVE-2017-15705)

Note that Nessus relies on the presence of the package as reported by the vendor.

the Apache Spamassassin project reports :

In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the 'open' event is immediately followed by a 'close' event - even if the tag *does not* close in the HTML being parsed.

Because of this, we are missing the 'text' event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service.

Fix a reliance on '.' in @INC in one configuration script. Whether this can be exploited in any way is uncertain.

Fix a potential Remote Code Execution bug with the PDFInfo plugin.
Thanks to cPanel Security Team for their report of this issue.

Fourth, this release fixes a local user code injection in the meta rule syntax. Thanks again to cPanel Security Team for their report of this issue.

The remote host is affected by the vulnerability described in GLSA-201812-07 (SpamAssassin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in SpamAssassin. Please       review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could execute arbitrary code, escalate privileges, or       cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
118117	CentOS 7 : spamassassin (CESA-2018:2916)	Nessus	CentOS Local Security Checks	10/16/2018	2/8/2022	high
118211	Amazon Linux AMI : spamassassin (ALAS-2018-1091)	Nessus	Amazon Linux Local Security Checks	10/19/2018	2/7/2022	critical
117840	Fedora 27 : spamassassin (2018-6ed251c42b)	Nessus	Fedora Local Security Checks	10/1/2018	8/1/2024	critical
118797	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : SpamAssassin vulnerabilities (USN-3811-1)	Nessus	Ubuntu Local Security Checks	11/7/2018	8/27/2024	critical
127217	NewStart CGSL CORE 5.04 / MAIN 5.04 : spamassassin Multiple Vulnerabilities (NS-SA-2019-0041)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	1/14/2021	high
142129	EulerOS 2.0 SP5 : spamassassin (EulerOS-SA-2020-2272)	Nessus	Huawei Local Security Checks	10/30/2020	2/13/2024	high
220670	Linux Distros Unpatched Vulnerability : CVE-2017-15705	Nessus	Misc.	3/4/2025	3/4/2025	medium
117721	FreeBSD : spamassassin -- multiple vulnerabilities (613193a0-c1b4-11e8-ae2d-54e1ad3d6335)	Nessus	FreeBSD Local Security Checks	9/27/2018	3/21/2022	critical
119703	GLSA-201812-07 : SpamAssassin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	12/17/2018	7/15/2024	critical

Detections

Analytics

Plugins Search

high

critical

critical

critical

high

high

medium

critical

critical