https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8525
Bug ID: 8525
Summary: AES-encrypted PDF decrypt failures with older Perl and
CryptX
Product: Spamassassin
Version: SVN Trunk (Latest Devel Version)
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P2
Component: Libraries
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: Undefined
Created attachment 6227
--> https://bz.apache.org/SpamAssassin/attachment.cgi?id=6227&action=edit
untaint the IV before calling Crypt::Mode::CBC
With Perl older than 5.18 and CryptX older than 0.081 (e.g., on CentOS 7), the
PDF handler fails on every AES-encrypted PDF, because Crypt::Mode::CBC rejects
the tainted IV.
The attached patch untaints the IV before calling Crypt::Mode::CBC.
--
You are receiving this mail because:
You are the assignee for the bug.
