- up to 3.4.6; fixes CVE-2020-1946 (in 3.4.5)

diff --git a/bug_771408_perl_version b/bug_771408_perl_version
index f51e0bf34897d98e214d8a003c1aac36ca17c5a0..e22b385ff3d2463117f8e8e24a283ed0ff3da781 100644 (file)
--- a/bug_771408_perl_version
+++ b/bug_771408_perl_version
@@ -1,9 +1,10 @@
 upstream fix for bug #771408
 Index: spamassassin-3.4.1/lib/Mail/SpamAssassin/Conf/Parser.pm
 ===================================================================
---- spamassassin-3.4.1.orig/lib/Mail/SpamAssassin/Conf/Parser.pm
-+++ spamassassin-3.4.1/lib/Mail/SpamAssassin/Conf/Parser.pm
-@@ -536,6 +536,9 @@ sub handle_conditional {
+diff -urNp -x '*.orig' Mail-SpamAssassin-3.4.4.org/lib/Mail/SpamAssassin/Conf/Parser.pm Mail-SpamAssassin-3.4.4/lib/Mail/SpamAssassin/Conf/Parser.pm
+--- Mail-SpamAssassin-3.4.4.org/lib/Mail/SpamAssassin/Conf/Parser.pm   2020-01-25 03:50:49.000000000 +0100
++++ Mail-SpamAssassin-3.4.4/lib/Mail/SpamAssassin/Conf/Parser.pm       2021-03-10 14:52:59.391415202 +0100
+@@ -537,6 +537,9 @@ sub handle_conditional {
      elsif ($token eq 'perl_version') {
        $eval .= $]." ";
      }
@@ -11,5 +12,5 @@ Index: spamassassin-3.4.1/lib/Mail/SpamAssassin/Conf/Parser.pm
 +      $eval .= $]." ";
 +    }
      elsif ($token =~ /^\w[\w\:]+$/) { # class name
-       my $u = untaint_var($token);
-       $eval .= '"' . $u . '" ';
+       # Strictly controlled form:
+       if ($token =~ /^(?:\w+::){0,10}\w+$/) {

diff --git a/spamassassin.spec b/spamassassin.spec
index a10c0d64838a88840b42f7f4a4e02ed84a599173..86dbef613aa6e06110c795bffa54af09becd4c17 100644 (file)
--- a/spamassassin.spec
+++ b/spamassassin.spec
@@ -11,12 +11,12 @@
 Summary:       A spam filter for email which can be invoked from mail delivery agents
 Summary(pl.UTF-8):     Filtr antyspamowy, przeznaczony dla programów dostarczających pocztę (MDA)
 Name:          spamassassin
-Version:       3.4.4
+Version:       3.4.6
 Release:       1
 License:       Apache v2.0
 Group:         Applications/Mail
 Source0:       http://ftp.ps.pl/pub/apache//spamassassin/source/%{pdir}-%{pnam}-%{version}.tar.bz2
-# Source0-md5: ce51fe5665d5838c56db6712846b58bb
+# Source0-md5: 0ef3f64ffcdf6f1e96068e19a16ce1be
 Source1:       %{name}.sysconfig
 Source2:       %{name}-spamd.init
 Source3:       %{name}-default.rc
@@ -355,6 +355,7 @@ fi
 
 # It's needed for help of spamassassin command.
 %{perl_vendorlib}/spamassassin-run.pod
+%{_mandir}/man1/sa-check_spamd.1*
 %{_mandir}/man1/sa-learn.1*
 %{_mandir}/man1/spamassassin.1*
 %{_mandir}/man1/spamassassin-run.1*