The release of the spam filtering platform - SpamAssassin 3.4.5 is now available. SpamAssassin employs a comprehensive approach to decision-making regarding blocking: messages undergo a series of checks (context analysis, black and white lists DNSBL, machine-learning Bayesian classifiers, signature checks, sender authentication through SPF and DKIM, etc.). After evaluating the message with various methods, a certain weight coefficient is accumulated. If the calculated coefficient exceeds a certain threshold, the message is blocked or marked as spam. Automatic rule update tools are supported. The package can be used on both client and server systems. SpamAssassin is written in Perl and is distributed under the Apache license.
The new release fixes a vulnerability (CVE-2020-1946) that allows an attacker to execute system commands when installing unverified blocking rules obtained from third-party sources. server when installing unverified blocking rules obtained from third-party sources.
Among the changes not related to security, improvements to the operation of the OLEVBMacro and AskDNS plugins are noted, enhancements in the data matching process in the Received and EnvelopeFrom headers, fixes in the SQL userpref schema, improvements in code for rbl and hashbl checks, and resolution of issues with TxRep tags.
It is noted that development of the 3.4.x series has been discontinued, and no changes will be made to this branch anymore. An exception is made only for vulnerability fixes, in which case a release 3.4.6 will be issued. All developer activity is focused on the development of the 4.0 branch, which will implement full built-in UTF-8 processing.
Source: opennet.ru
