LibClamAV Warning: Unsupported message format `global-headers'

[Nils Toedtmann]

clamscan throws "LibClamAV Warning: Unsupported message format `global-headers'" when scanning e.g. the exim4 binary from recent releases.

When running clamscan as cronjob, such STDERR warnings produce disruptive rootmail noise.

For example on my current Ubuntu Focal:

$ apt download exim4-daemon-light
  Get:1 http://gb.archive.ubuntu.com/ubuntu focal-updates/main amd64 exim4-daemon-light amd64 4.93-13ubuntu1.5 [534 kB]
  Fetched 534 kB in 0s (3,220 kB/s)
$ ar x exim4-daemon-light_4.93-13ubuntu1.5_amd64.deb
$ tar xf data.tar.xz
$ clamscan ./usr/sbin/exim4
LibClamAV Warning: Unsupported message format `global' - if you believe this file contains a virus, submit it to www.clamav.net

Using clamav 0.103.2+dfsg-0ubuntu0.20.04 on Ubuntu 20.04.3

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Nils Toedtmann (m-launchpad-net-mail-nils-toedtmann-net)]

Apologies for the mismatch between this report's title and description ("Unsupported message format `global-headers'" vs "...`global'").

clamscan throws the warning I mentioned in the title when scanning an exim4 binary from Debian 11:

$ wget -q http://ftp.debian.org/debian/pool/main/e/exim4/exim4-daemon-light_4.94.2-7_amd64.deb
$ ar x exim4-daemon-light_4.94.2-7_amd64.deb
$ tar xf data.tar.xz
$ clamscan ./usr/sbin/exim4
LibClamAV Warning: Unsupported message format `global-headers' - if you believe this file contains a virus, submit it to www.clamav.net

(We are scanning Debian-based docker containers from Ubuntu-based docker hosts)

[Athos Ribeiro (athos-ribeiro)]

Hi Nils, thanks for reporting the issue. I could reproduce the issue in impish by following your reproducing steps (thanks).

Note that, while there is a warning, clamscan does exit with an 0 status code.

Finally, this seems to be a bug to be reported upstream. I am marking this bug as triaged now. Would you like to also file this issue upstream?