Fedora EPEL 4 updates-testing report

[updates at fedoraproject.org]

The following builds have been pushed to Fedora EPEL 4 updates-testing

    spamass-milter-0.3.1-18.el4

Details about builds:


================================================================================
 spamass-milter-0.3.1-18.el4 (FEDORA-EPEL-2010-2473)
 Milter (mail filter) for spamassassin
--------------------------------------------------------------------------------
Update Information:

This update includes a fix for a problem where if the milter is running using
the "-x" option to expand aliases before passing inbound mail through
SpamAssassin, a malicious client using a carefully-crafted SMTP session could
execute arbitrary code on the mail server. The fix avoids the use of a shell in
the alias expansion and hence there is no longer a problem with having to
sanitize input from the client.    No CVE number has yet been assigned to this
problem, which is tracked upstream at https://savannah.nongnu.org/bugs/?29136
The update also contains improved Received-header-generation for message
submission and a fix for a problem where the milter would erroneously log
warnings about the mail server's configuration when the first message from a
non-authenticated client passed through. As part of the fix for this issue, the
required milter macro configuration for the mail server has changed slightly:
see the README file included in the package for details.
--------------------------------------------------------------------------------
ChangeLog:

* Tue Mar 23 2010 Paul Howarth <paul at city-fan.org> 0.3.1-18
- Add patch to get rid of compiler warnings
- Reorder and re-base patches to optimize chances of upstream accepting them
- Improve Received-header patch (#496763) incorporating additional fix from
  upstream update (http://savannah.nongnu.org/bugs/?17178)
* Fri Mar 12 2010 Paul Howarth <paul at city-fan.org> 0.3.1-17
- Update initscript to support running the milter as root, which is needed
  for the -x (expand aliases) option; note that the milter does not run as
  root by default
- Add patch for popen unsanitized input vulnerability
  (#572117, #572119, http://savannah.nongnu.org/bugs/?29136)
- Rebase authuser patch
- Update patch adding auth info to dummy Received-header so that it doesn't
  generate spurious warnings about missing macros (#532266), and update and
  merge the macro documentation patch into this patch
- Document patch usage in spec file
* Tue Aug 11 2009 Paul Howarth <paul at city-fan.org> 0.3.1-16
- Switch to bzipped source tarball
* Sun Jul 26 2009 Fedora Release Engineering <rel-eng at lists.fedoraproject.org> 0.3.1-15
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
* Fri Apr 24 2009 Paul Howarth <paul at city-fan.org> 0.3.1-14
- Fix Received-header generation (#496763)
- Add authentication info to dummy Received-header (#496769)
- Add option to skip checks for authenticated senders (#437506, #496767)
  (thanks to Habeeb J. Dihu for the reports and patches)
* Wed Mar 18 2009 Paul Howarth <paul at city-fan.org> 0.3.1-13
- Call initscripts directly instead of via /sbin/service and fine-tune scriptlet
  dependencies
- Change sa-milt user's home directory from
  %{_localstatedir}/run/spamass-milter to %{_localstatedir}/lib/spamass-milter
  so as to retain directory contents across a reboot (#489995), and fix the home
  directory of any existing sa-milt account on upgrades
* Fri Feb 27 2009 Paul Howarth <paul at city-fan.org> 0.3.1-12
- Subpackage for postfix is now noarch for Fedora 10 onwards
- Fix scriptlet deps to ensure that sa-milt user exists before we attempt to
  add it to the postfix group
* Wed Feb 25 2009 Fedora Release Engineering <rel-eng at lists.fedoraproject.org> 0.3.1-11
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
* Fri Feb 13 2009 Paul Howarth <paul at city-fan.org> 0.3.1-10
- Rebuild for shared libmilter in Fedora 11 development
* Thu Jul  3 2008 Paul Howarth <paul at city-fan.org> 0.3.1-9
- Require /usr/sbin/sendmail (for -b/-B/-x options) rather than sendmail pkg
- Make summary and description less Sendmail-specific
- Add patch to support group-writable socket for MTA communication, needed
  to be able to use a Unix-domain socket with Postfix (#452248)
- Add subpackage with group-writable directory for Postfix support
- Tweak initscript to change default options when Postfix socket directory is
  present
- Document additional ENVRCPT macros to provide
* Tue May 20 2008 Paul Howarth <paul at city-fan.org> 0.3.1-8
- Fix initscript failure to start with SELinux in enforcing mode (#447247)
  (needs selinux-policy >= 3.3.1-55 on F9)
* Tue Feb 19 2008 Fedora Release Engineering <rel-eng at fedoraproject.org> 0.3.1-7
- Autorebuild for GCC 4.3
* Mon Feb 18 2008 Paul Howarth <paul at city-fan.org> 0.3.1-6
- Rebuild with gcc 4.3.0 for Fedora 9
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #572117 - SpamAssassin Mail Filter: Arbitrary shell command injection (privilege escalation)
        https://bugzilla.redhat.com/show_bug.cgi?id=572117
--------------------------------------------------------------------------------