CVE-2017-15705
published 2018-09-17CVE-2017-15705: A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails…
PriorityP432medium5.3CVSS 3.0
AVNACLPRNUINSUCNINAL
ITW
Exploited in the wild
EPSS
7.88%
94.0th percentile
A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close" event - even if the tag *does not* close in the HTML being parsed. Because of this, we are missing the "text" event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service. The issue is possibly a bug or design decision in HTML::Parser that specifically impacts the way Apache SpamAssassin uses the module with poorly formed html. The exploit has been seen in the wild but not believed to have been purposefully part of a Denial of Service attempt. We are concerned that there may be attempts to abuse the vulnerability in the future.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | spamassassin | < 3.4.2 | 3.4.2 |
| apache | spamassassin | >= 0 < 3.4.2-1 | 3.4.2-1 |
| apache | spamassassin | >= 0 < 3.4.2-1 | 3.4.2-1 |
| apache | spamassassin | >= 0 < 3.4.2-1 | 3.4.2-1 |
| apache | spamassassin | >= 0 < 3.4.2-1 | 3.4.2-1 |
| apache | spamassassin | >= 0 < 3.4.2-0ubuntu0.14.04.1 | 3.4.2-0ubuntu0.14.04.1 |
| apache | spamassassin | >= 0 < 3.4.2-0ubuntu0.16.04.1 | 3.4.2-0ubuntu0.16.04.1 |
| apache | spamassassin | >= 0 < 3.4.2-0ubuntu0.18.04.1 | 3.4.2-0ubuntu0.18.04.1 |
| apache_software_foundation | apache_spamassassin | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | spamassassin | < spamassassin 3.4.2-1 (bookworm) | spamassassin 3.4.2-1 (bookworm) |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
vendor_ubuntu5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
SpamAssassin vulnerability
vendor_ubuntu·2018-11-13·CVSS 5.3
CVE-2017-15705 [MEDIUM] SpamAssassin vulnerability
Title: SpamAssassin vulnerability
Summary: SpamAssassin could be made to crash if it received
a specially crafted file.
USN-3811-1 fixed a vulnerability in SpamAssassin. This update provides
the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
It was discovered that SpamAssassin incorrectly handled certain unclosed
tags in emails. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2017-15705)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
SpamAssassin vulnerabilities
vendor_ubuntu·2018-11-06·CVSS 5.3
CVE-2017-15705 [MEDIUM] SpamAssassin vulnerabilities
Title: SpamAssassin vulnerabilities
Summary: Several security issues were fixed in SpamAssassin.
It was discovered that SpamAssassin incorrectly handled certain unclosed
tags in emails. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2017-15705)
It was discovered that SpamAssassin incorrectly handled the PDFInfo plugin.
A remote attacker could possibly use this issue to execute arbitrary code.
(CVE-2018-11780)
It was discovered that SpamAssassin incorrectly handled meta rule syntax. A
local attacker could possibly use this issue to execute arbitrary code.
(CVE-2018-11781)
Instructions: This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
Red Hat
spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and result in denial of service
vendor_redhat·2018-09-17·CVSS 5.3
CVE-2017-15705 [MEDIUM] CWE-400 spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and result in denial of service
spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and result in denial of service
A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close" event - even if the tag *does not* close in the HTML being parsed. Because of this, we are missing the "text" event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service. The issue
Debian
CVE-2017-15705: spamassassin - A denial of service vulnerability was identified that exists in Apache SpamAssas...
vendor_debian·2017·CVSS 5.3
CVE-2017-15705 [MEDIUM] CVE-2017-15705: spamassassin - A denial of service vulnerability was identified that exists in Apache SpamAssas...
A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close" event - even if the tag *does not* close in the HTML being parsed. Because of this, we are missing the "text" event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service. The issue is possibly a bug or design decision in HTML::Parser that specifically impacts the way Apache SpamAssassin use
GHSA
GHSA-m63q-qrvc-wwrm: A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3
ghsa_unreviewed·2022-05-14
CVE-2017-15705 [MEDIUM] CWE-20 GHSA-m63q-qrvc-wwrm: A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3
A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close" event - even if the tag *does not* close in the HTML being parsed. Because of this, we are missing the "text" event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service. The issue is possibly a bug or design decision in HTML::Parser that specifically impacts the way Apache SpamAssassin use
OSV
spamassassin vulnerabilities
osv·2018-11-06·CVSS 5.3
CVE-2017-15705 [MEDIUM] spamassassin vulnerabilities
spamassassin vulnerabilities
It was discovered that SpamAssassin incorrectly handled certain unclosed
tags in emails. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2017-15705)
It was discovered that SpamAssassin incorrectly handled the PDFInfo plugin.
A remote attacker could possibly use this issue to execute arbitrary code.
(CVE-2018-11780)
It was discovered that SpamAssassin incorrectly handled meta rule syntax. A
local attacker could possibly use this issue to execute arbitrary code.
(CVE-2018-11781)
OSV
CVE-2017-15705: A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3
osv·2018-09-17·CVSS 5.3
CVE-2017-15705 [MEDIUM] CVE-2017-15705: A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3
A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close" event - even if the tag *does not* close in the HTML being parsed. Because of this, we are missing the "text" event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service. The issue is possibly a bug or design decision in HTML::Parser that specifically impacts the way Apache SpamAssassin use
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-15705 spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and resulting denial of service [fedora-all]
bugzilla·2018-09-17·CVSS 5.3
CVE-2017-15705 [MEDIUM] CVE-2017-15705 spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and resulting denial of service [fedora-all]
CVE-2017-15705 spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and resulting denial of service [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit me
Bugzilla
CVE-2017-15705 spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and result in denial of service
bugzilla·2018-09-17·CVSS 5.3
CVE-2017-15705 [MEDIUM] CVE-2017-15705 spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and result in denial of service
CVE-2017-15705 spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and result in denial of service
Apache SpamAssassin before version 3.4.2 is vulnerable to a denial of service in the handling of crafted email. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts.
External Reference:
https://mail-archives.apache.org/mod_mbox/spamassassin-announce/201809.mbox/raw/%3Cc57c0f41-742c-3c3e-249c-ae2614bf0d7d%40apache.org%3E/
Discussion:
Created spamassassin tracking bugs for this issue:
Affects: fedora-all [bug 1629522]
---
Upstream patch:
https://svn.apache.org/viewvc?view=revision&revision=1815853
https://svn.apache.org/viewvc?view=revision&revision=1815688
---
This issue has been
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00002.htmlhttp://www.securityfocus.com/bid/105347https://access.redhat.com/errata/RHSA-2018:2916https://lists.apache.org/thread.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c%40%3Cannounce.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2018/11/msg00016.htmlhttps://security.gentoo.org/glsa/201812-07https://usn.ubuntu.com/3811-1/https://usn.ubuntu.com/3811-2/http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00002.htmlhttp://www.securityfocus.com/bid/105347https://access.redhat.com/errata/RHSA-2018:2916https://lists.apache.org/thread.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c%40%3Cannounce.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2018/11/msg00016.htmlhttps://security.gentoo.org/glsa/201812-07https://usn.ubuntu.com/3811-1/https://usn.ubuntu.com/3811-2/
2018-09-17
Published
Exploited in the wild