Description
In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Apache Apache SpamAssassin
Apache SpamAssassin prior to 3.4.3affected
References
- https://lists.apache.org/thread.html/64cf76749956dd08f7d5b86ec9f3321f382cfd7fe717ccd1be940c92%40%3Cannounce.spamassassin.apache.org%3E ↗
- https://lists.apache.org/thread.html/e3c2367351286b77a74a082e2b66b793cceefa7b6ea9dcd162db4c4b%40%3Cdev.spamassassin.apache.org%3E ↗
- https://lists.apache.org/thread.html/5ef362d6da12126fafc81443309ca95d872d1bfd011fe4b2699f0fe9%40%3Cusers.spamassassin.apache.org%3E ↗
- http://www.openwall.com/lists/oss-security/2019/12/12/2 ↗
- https://lists.apache.org/thread.html/5863d6c42fc9595a29566732f12348cde0ca0e41bda91695c62041de%40%3Cannounce.apache.org%3E ↗
- https://svn.apache.org/repos/asf/spamassassin/branches/3.4/build/announcements/3.4.3.txt ↗
- https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7747 ↗
- https://www.debian.org/security/2019/dsa-4584 ↗
- https://seclists.org/bugtraq/2019/Dec/27 ↗
- https://lists.debian.org/debian-lts-announce/2019/12/msg00019.html ↗
- https://usn.ubuntu.com/4237-1/ ↗
- https://usn.ubuntu.com/4237-2/ ↗
- https://lists.apache.org/thread.html/r2578c486552637bfedbe624940cc60d6463bd90044c887bdebb75e74%40%3Cusers.spamassassin.apache.org%3E ↗
- https://lists.apache.org/thread.html/r3d32ebf97b1245b8237763444e911c4595d2ad5e34a1641840d8146f%40%3Cusers.spamassassin.apache.org%3E ↗