We hit a DKIM bomb email on our system
Brought to you by:
jasonlong
Menu
▾
▴
#36 We hit a DKIM bomb email on our system
We hit a DKIM bomb email on our system. This single email requires 7GB
of ram to be verified via spamassassin or dkimverify.pl.
This is first time I have ever seen this kind of dkim bomb but I'm very
sure this won't be last time if this inefficiency isn't being fixed.
On very fast machine with it took nearly 7 minutes to verify this email
with dkimverify.pl.
This is clearly a bomb which is designed to break ssytems using Mail::DKIM.
--
Submitted by Tuomo Soini (@d-fence.fi)
The sample email he sent to me contained over 3800 DKIM-Signature headers.
Note to self: each canonicalization object keeps a copy of the entire header, this is why the system runs out of memory with so many signatures. I.e. memory usage is (size of header) TIMES (number of signatures).
It does this because it takes into account the header ordering only after the entire header has been read. I think this can be changed.
fixed for version 0.39