Updated spamassassin packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team.

- ---------------------------------------------------------------------                   Red Hat Security Advisory

Synopsis:          Important: spamassassin security update
Advisory ID:       RHSA-2007:0075-02
Advisory URL:      https://access.redhat.com/errata/RHSA-2007:0075.html
Issue date:        2007-03-13
Updated on:        2007-03-14
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2007-0451 
- ---------------------------------------------------------------------1. Summary:

Updated spamassassin packages that fix a security issue are now available
for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

3. Problem description:

SpamAssassin provides a way to reduce unsolicited commercial email (spam)
from incoming email.

A flaw was found in the way SpamAssassin processes HTML email containing
URIs. A carefully crafted mail message could cause SpamAssassin to consume
significant resources. If a number of these messages are sent, this could
lead to a denial of service, potentially delaying or preventing the
delivery  of email. (CVE-2007-0451)

Users of SpamAssassin should upgrade to these updated packages which
contain version 3.1.8 which is not vulnerable to these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  

This update is available via Red Hat Network.  Details on how to use 
the Red Hat Network to apply this update are available at

5. Bug IDs fixed (http://bugzilla.redhat.com/):

228587 - CVE-2007-0451 Spamassassin DoS

6. RPMs required:

Red Hat Enterprise Linux Desktop (v. 5 client):

SRPMS:
1b3d756e97bd37694b8682de4cf2437b  spamassassin-3.1.8-2.el5.src.rpm

i386:
46f02b67cfc960bb5d870e53d2c160aa  spamassassin-3.1.8-2.el5.i386.rpm
b0d0d32cd64986d8d47e28c638e5c6cb  spamassassin-debuginfo-3.1.8-2.el5.i386.rpm

x86_64:
464cc3d1cf3bc0ab2707e2dcb3b250da  spamassassin-3.1.8-2.el5.x86_64.rpm
a8516e321cc11bf556735f7824045d24  spamassassin-debuginfo-3.1.8-2.el5.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

SRPMS:
1b3d756e97bd37694b8682de4cf2437b  spamassassin-3.1.8-2.el5.src.rpm

i386:
46f02b67cfc960bb5d870e53d2c160aa  spamassassin-3.1.8-2.el5.i386.rpm
b0d0d32cd64986d8d47e28c638e5c6cb  spamassassin-debuginfo-3.1.8-2.el5.i386.rpm

ia64:
9c9c9f9d1b05c6f70210d94196661dba  spamassassin-3.1.8-2.el5.ia64.rpm
2e467dc6cf71068568748a24281d2f24  spamassassin-debuginfo-3.1.8-2.el5.ia64.rpm

ppc:
d77b85e1c132b88526210bc121e67642  spamassassin-3.1.8-2.el5.ppc.rpm
53f9f1790f2bf708438e6ca89966e873  spamassassin-debuginfo-3.1.8-2.el5.ppc.rpm

s390x:
2c98423a9762e50eb206daa59172b0e7  spamassassin-3.1.8-2.el5.s390x.rpm
faf074eed8e821200108ebf42403eefe  spamassassin-debuginfo-3.1.8-2.el5.s390x.rpm

x86_64:
464cc3d1cf3bc0ab2707e2dcb3b250da  spamassassin-3.1.8-2.el5.x86_64.rpm
a8516e321cc11bf556735f7824045d24  spamassassin-debuginfo-3.1.8-2.el5.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://access.redhat.com/security/team/key#package

7. References:

https://www.cve.org/CVERecord?id=CVE-2007-0451
https://access.redhat.com/security/updates/classification#important

8. Contact:

The Red Hat security contact is .  More contact
details at https://access.redhat.com/security/team/contact

Copyright 2007 Red Hat, Inc.