Skip to content
Fencer Vulns
medium 5.3

CVE-2017-15705 json

A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2.

published 2018-09-17 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-7138

cvss
5.3
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
7.9%
EPSS 7.9% chance of exploitation in 30 days, percentile 94%
public exploits
0
none known

Summary

A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close" event - even if the tag *does not* close in the HTML being parsed. Because of this, we are missing the "text" event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service. The issue is possibly a bug or design decision in HTML::Parser that specifically impacts the way Apache SpamAssassin uses the module with poorly formed html. The exploit has been seen in the wild but not believed to have been purposefully part of a Denial of Service attempt. We are concerned that there may be attempts to abuse the vulnerability in the future.

Patch / fix

  • apache spamassassin 3.4.2
  • spamassassin Debian 14, Debian 13, Debian 12 3.4.2-1

debian advisories DEBIAN-CVE-2017-15705

  • spamassassin Ubuntu 14.04 LTS 3.4.2-0ubuntu0.14.04.1
  • spamassassin Ubuntu 16.04 LTS 3.4.2-0ubuntu0.16.04.1
  • spamassassin Ubuntu 18.04 LTS 3.4.2-0ubuntu0.18.04.1

ubuntu advisories UBUNTU-CVE-2017-15705

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • spamassassin RHEL 7 3.4.0-4.el7_5

red hat advisories RHSA-2018:2916

  • spamassassin SLE Module for Development Tools 15, SLE Module for Basesystem 15 3.4.2-7.4.1
  • spamassassin SLES for SAP 12 SP4, SLES 12 SP4, SLED 12 SP4 3.4.2-44.3.1

suse advisories SUSE-SU-2019:2011-1SUSE-SU-2019:1961-1

  • spamassassin openSUSE Tumbleweed 3.4.6-71.3
  • spamassassin openSUSE Leap 15.0 3.4.2-lp150.6.3.1

opensuse advisories openSUSE-SU-2024:11395-1openSUSE-SU-2019:1831-1

  • spamassassin Alpine 3.24, Alpine 3.23, Alpine 3.22 +13 more 3.4.2-r0
  • spamassassin Alpine 3.8 3.4.3-r0

alpine advisories ALPINE-CVE-2017-15705

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-15705 updated cvss 7.5

spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and result in denial of service

  • Red Hat Enterprise Linux 5 spamassassin Red Hat Enterprise Linux 6 spamassassin
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux Client Optional (v. 7) spamassassin 3.4.0-4.el7_5 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) spamassassin 3.4.0-4.el7_5 Red Hat Enterprise Linux Server (v. 7) spamassassin 3.4.0-4.el7_5 Red Hat Enterprise Linux Workstation (v. 7) spamassassin 3.4.0-4.el7_5
    fixed: vendor fix RHSA-2018:2916
  • Red Hat Enterprise Linux 8 spamassassin
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

7.88% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • Apache Software Foundation Apache SpamAssassin

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.