Improper input validation in SpamAssassin - CVE-2017-15705

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU16549

Improper input validation in SpamAssassin - CVE-2017-15705

Published: December 15, 2018 / Updated: December 17, 2018


Vulnerability identifier: #VU16549
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-15705
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists in Apache SpamAssassin, using HTML::Parser due to an the "open" event is immediately followed by a "close" event - even if the tag *does not* close in the HTML being parsed when an object and hook are setup into the begin and end tag event handlers. A remote attacker can supply certain unclosed tags in specially crafted emails that cause markup to be handled incorrectly leading to scan timeouts.


Affected software

SpamAssassin
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power
Opensuse
Fedora
spamassassin (Alpine package)
spamassassin

How to mitigate CVE-2017-15705

Update to version 3.4.2.

SpamAssassin - update to 3.4.2
spamassassin (Alpine package) - addressed in versions 3.4.2-r0, 3.4.3-r0
spamassassin - addressed in versions 3.4.2-1.fc27, 3.4.2-1.fc28, 3.4.2-1.fc29, 3.4.2-2.fc27, 3.4.2-2.fc28, 3.4.2-2.fc29

External References

Related Security Bulletins