[Bug 254526] [PATCH] mail/spamassassin Update to 3.4.5 fixing CVE-2020-1946

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=254526

            Bug ID: 254526
           Summary: [PATCH] mail/spamassassin Update to 3.4.5 fixing
                    CVE-2020-1946
           Product: Ports & Packages
           Version: Latest
          Hardware: Any
               URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-19
                    46
                OS: Any
            Status: New
          Keywords: security
          Severity: Affects Many People
          Priority: ---
         Component: Individual Port(s)
          Assignee: zeising at FreeBSD.org
          Reporter: cy at FreeBSD.org
                CC: ports-bugs at FreeBSD.org, ports-secteam at FreeBSD.org
             Flags: maintainer-feedback?(zeising at FreeBSD.org)
             Flags: merge-quarterly?

This patch updates mail/spamassassin to 3.4.5 fixing CVE-2020-1946. Email from
apache.org below:

Subject: [CVE-2020-1946] Apache SpamAssassin malicious rule configuration
 (.cf) files can be configured to run system commands
From: Sidney Markowitz <sidney at apache.org>
Date: Thu, 25 Mar 2021 05:08:23 +1300 (Wed 09:08 PDT)
To: Sidney Markowitz <sidney at apache.org>

(Unknown charset: <utf-8>)

Apache SpamAssassin 3.4.5 was recently released [1], and fixes an issue of
security note where malicious rule configuration (.cf) files can be configured
to run system commands.

In Apache SpamAssassin before 3.4.5, exploits can be injected in a number of
scenarios. In addition to upgrading to SA 3.4.5, users should only use update
channels or 3rd party .cf files from trusted places.

Apache SpamAssassin would like to thank Damian Lukowski at credativ for
ethically reporting this issue.

This issue has been assigned CVE id CVE-2020-1946 [2]

To contact the Apache SpamAssassin security team, please e-mail
security at spamassassin.apache.org. For more information about Apache
SpamAssassin, visit the https://spamassassin.apache.org/ web site.

Apache SpamAssassin Security Team

[1]: https://s.apache.org/ng9u9

[2]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-1946

-- 
Sidney Markowitz
Chair, Apache SpamAssassin PMC
sidney at apache.org

-- 
You are receiving this mail because:
You are on the CC list for the bug.