#3 CVE-2018-11805 implemented, sa-exim plugin stop to work.

[Marco Gaiarin]

I've just updated on debian spamassassin to version 3.4.2-1~deb9u2, implementing patches for CVE-2018-11805 and CVE-2019-12420; i suppose the former add stricter checking, preventing sa-exim to work; in logs i got:

Dec 16 10:03:20 vdmpp1 spamd[15196]: rules: failed to run GREYLIST_ISWHITE test, skipping:
Dec 16 10:03:20 vdmpp1 spamd[15196]:  (Insecure dependency in eval while running with -T switch at /usr/share/perl5/Mail/SpamAssassin/Plugin/Greylisting.pm line 76.
Dec 16 10:03:20 vdmpp1 spamd[15196]: )

I hope on a quick fix. Thanks.

[Marco Gaiarin]

Found a workaround. In local.cf plugin are called with:

ifplugin Greylisting
  header GREYLIST_ISWHITE eval:greylisting("( 'dir' => '/var/spool/sa-exim/tuplets'; 'method' => 'dir'; 'greylistsecs' => '1800'; 'dontgreylistthreshold' => 10; 'connectiphdr' => 'X-SA-Exim-Connect-IP'; 'en
  describe GREYLIST_ISWHITE The incoming server has been whitelisted for this recipient and sender
  score GREYLIST_ISWHITE  -1.5
  priority GREYLIST_ISWHITE 99999
endif # Greylisting

With this simple patch/hack:

--- /usr/share/perl5/Mail/SpamAssassin/Plugin/Greylisting.pm.orig   2019-12-16 12:12:53.360189565 +0100
+++ /usr/share/perl5/Mail/SpamAssassin/Plugin/Greylisting.pm    2019-12-16 12:15:04.592765200 +0100
@@ -73,7 +73,16 @@

     $optionhash  =~ s/;/,/g;
     # This is safe, right? (users shouldn't be able to set it in their config)

-    %option=eval $optionhash;
+    #%option=eval $optionhash;
+    %option = ('dir' => '/var/spool/sa-exim/tuplets',
+       'method' => 'dir',
+       'greylistsecs' => '1800',
+       'dontgreylistthreshold' => 10,
+       'connectiphdr' => 'X-SA-Exim-Connect-IP',
+       'envfromhdr' => 'X-SA-Exim-Mail-From',
+       'rcpttohdr' => 'X-SA-Exim-Rcpt-To',
+       'greylistnullfrom' => 1,
+       'greylistfourthbyte' => 0 );
     $self->{'rangreylisting'}=1;

     foreach my $reqoption (qw ( method greylistsecs dontgreylistthreshold

So seems that calling directly eval() in plugins is not permitted anymode, and a new way to pass plugin parameters is needed.

[Marco Gaiarin]

Debian bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=946829

[Marco Gaiarin]

Patch built by Henrik Krohns, see Debian BTS.