Spamassassin needs updated to reflect security fixes

[chris pollock]

lsb_release -rd
Description: Ubuntu 18.04.3 LTS
Release: 18.04

apt-cache policy spamassassin
spamassassin:
  Installed: 3.4.2-0ubuntu0.18.04.1
  Candidate: 3.4.2-0ubuntu0.18.04.1

The current version of Spamassassin is 3.4.2, the newest version, 3.4.3 fixes two security issues:

CVE-2019-12420 for Multipart Denial of Service Vulnerability

CVE-2018-11805 for nefarious CF files can be configured to
run system commands without any output or errors.

Request that Spamassassin be updated to the latest version 3.4.3 as soon as possible.

[Christian Ehrhardt  (paelzer)]

Hi Chris,
thanks for your report.
I checked the security Teams overview of those at
- https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-11805.html
- https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-12420.html

It seems they are still evaluating the options hence the status "needs Triage".
I'll assign this bug to ubuntu-security so that they can update this bug along whatever they decide on the CVE triaging.

[Christian Ehrhardt  (paelzer)]

@Chris - security team told me on IRC on Friday that they will take a look as part of their normal triage.
To be on the safe side lets ping here again.

*ping*

[chris pollock (cpollock)]

Thanks Christian, appreciate the update.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[chris pollock (cpollock)]

I received an update to Spamassassin today however it was only to

 apt-cache policy spamassassin
spamassassin:
  Installed: 3.4.2-0ubuntu0.18.04.2
  Candidate: 3.4.2-0ubuntu0.18.04.2

The installed version I had prior to this was 3.4.2-0ubuntu0.18.04.1. Why wasn't this updated to the current version 3.4.3 as I stated in my initial bug report?

[Seth Arnold (seth-arnold)]

Hello Chris, for both security updates and bug fixes we prefer to backport specific fixes for specific bugs rather than switch to new versions, as described in https://wiki.ubuntu.com/SecurityTeam/FAQ#Versions

Thanks

[chris pollock (cpollock)]

Got it Seth, thanks for the explanation.