Denial of Service Vulnerability in SpamAssassin: Apache SpamAssassin Versions Prior to 3.4.2
Summary
ALPINE-CVE-2017-15705: A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. Affects spamassassin versions < 3.4.2-r0. Fixed in 3.4.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache SpamAssassin is an open-source email filtering platform that uses a variety of mechanisms to identify and filter spam emails. It employs techniques such as header and body analysis, Bayesian filtering, and DNS-based blackhole lists. The software is widely used in email servers to enhance email security by reducing unwanted spam. However, certain versions of SpamAssassin are vulnerable to a denial of service (DoS) attack due to improper handling of unclosed HTML tags in emails.
Vulnerability Detail
A denial of service vulnerability exists in Apache SpamAssassin versions prior to 3.4.2. This vulnerability arises from the handling of certain unclosed tags in emails, which can lead to scan timeouts. When SpamAssassin processes emails using HTML::Parser, it sets up an object that hooks into the begin and end tag event handlers. If an open tag is immediately followed by a close tag, even if the tag does not close in the HTML, the parser misses the text event, causing the object to behave unexpectedly. This can lead to crafted emails taking longer to scan than anticipated, potentially resulting in a denial of service. The issue may stem from a bug or design decision in HTML::Parser, particularly affecting how SpamAssassin utilizes the module with poorly formed HTML. Although the exploit has been observed in the wild, it is not believed to have been intentionally used for denial of service attacks.
How To Fix
Minimum fixed version
3.4.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade spamassassinTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can filter incoming emails to remove or sanitize HTML content before it reaches SpamAssassin. This can help mitigate the risk of triggering the vulnerability while a permanent fix is implemented.
Conclusion
In summary, the denial of service vulnerability in Apache SpamAssassin versions prior to 3.4.2 poses a risk to email filtering processes. It is crucial to update to the patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for spamassassin →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
All versions of Apache SpamAssassin prior to 3.4.2 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to denial of service, where the email filtering process may become unresponsive or take excessively long to complete, impacting email delivery and server performance.
While the exploit has been seen in the wild, it is not believed to have been used intentionally for denial of service attacks. However, there is a concern that it may be exploited in the future.
References
Related vulnerabilities
Recent vulnerabilities recorded for spamassassin.
