Bug#946958: sa-compile failing on Graylisting.pm

2020-01-02 Thread Shannon Dealy
On Wed, 18 Dec 2019, Noah Meyerhans wrote: [snip] The problem is likely related to the fixes for CVE-2018-11805, which involved malicious rulesets invoking arbitrary commands as the uid running spamassassin/spamd. In the case of sa-exim, the line triggering the taint failure is performing an

Bug#946958: sa-compile failing on Graylisting.pm

2019-12-18 Thread Noah Meyerhans
On Wed, Dec 18, 2019 at 07:10:48AM -0600, de...@deatech.com wrote: > I considered that this bug may belong to the sa-exim package which is the > source of the Graylisting.pm file, however, it is the sa-compile package that > changed not sa-exim and sa-compile is the one with the broken

Bug#946958: sa-compile failing on Graylisting.pm

2019-12-18 Thread Noah Meyerhans
On Wed, Dec 18, 2019 at 07:10:48AM -0600, de...@deatech.com wrote: > Setting up sa-compile (3.4.2-0+deb8u2) ... > Running sa-compile (may take a long time) > rules: failed to run GREYLIST_ISWHITE test, skipping: > (Insecure dependency in eval while running with -T switch at >

Bug#946958: sa-compile failing on Graylisting.pm

2019-12-18 Thread dealy
Package: sa-compile Version: 3.4.2-0+deb8u2 Severity: normal Dear Maintainer, After the latest security update to spamassassin, sa-compile was left incompletely installed due to the following failure (which now happens every time I install/remove anything using apt-get): Setting up