[WebUI] Update RequireJS to address CVE-2024-38999
Upgraded RequireJS from 2.3.6 to 2.3.7
to mitigate prototype pollution vulnerability (CVE-2024-38999) in `s.contexts._.configure` function,
which could allow arbitrary code execution or Denial of Service.
twesterhever [Mon, 4 Nov 2024 11:59:22 +0000 (11:59 +0000)]
[Minor] Add "User" HELO in Received headers to ABUSE_FROM_INJECTOR
This pattern often surfaces in spam (frequently advance fee fraud)
disseminated via compromised accounts, adding it to ABUSE_FROM_INJECTOR
to increase the likelihood of such spam getting rejected.
* add more validation on empty strings, required to not face errors in saving logs to elastic
* remove max_size as it was looking to rows elements count, not strings size in total, such check will be too much compute intensive
* increase default errors max_fail as usually elastic not recover so quickly and needs a bit more time
Jan Schär [Sat, 19 Oct 2024 22:08:36 +0000 (00:08 +0200)]
[CritFix] Fix ARC-Seal signing
Signing of ARC-Seal headers was recently broken; the created signatures
failed to validate. Most likely, this was caused by commit 1e661a2fc6e3,
which changed the way signatures are created in lua_rsa_sign_memory
without adding the calls to EVP_PKEY_CTX_set_rsa_padding and
EVP_PKEY_CTX_set_signature_md needed with the new interface.
After fixing this, some existing tests failed, because the test values
passed to the hash parameter did not have the correct size for a sha256
hash. I fixed these by adjusting the length of the test values.
Additionally, I extended the "RSA sign" unit test to compare the created
signature against the expected one. This is possible because RSA signing
is deterministic, and should prevent the same bug from occuring again.
Petr Vaněk [Wed, 2 Oct 2024 13:01:07 +0000 (15:01 +0200)]
[Fix] Use correct type for keylen in lua_ucl_newindex
The keylen variable used in lua_ucl_newindex function should use size_t
type instead of lua_Integer, because all functions that use keylen
expect it to be of size_t type. This mismatch leads to incompatible
pointer types, and modern versions of GCC fail to compile the code.
* [Conf] Add SenderScore RPBL return codes
* [Conf] Add SenderScore Reputationlist RBL
* [Conf] Increase scores for strange things in the archives
* [CritFix] The max size for signing key is actually 65 bytes for p256
* [Feature] Add rspamadm secretbox command
* [Feature] Add rspamd_cxx_unit_cryptobox for unit testing
* [Feature] Add support for OpenSSL 3.0
* [Feature] Add support for OpenSSL 3.0 for DKIM
* [Feature] Add tests for rspamd_cryptobox
* [Feature] Add tooling to encrypt strings in Lua
* [Feature] Allow differen modes for fuzzy rules
* [Feature] Allow to set negative group score limit via `min_score`
* [Feature] DMARC: Implement reporting.only_domains setting
* [Fix] Add workaround for the bug in OpenSSL < 3.0.8
* [Fix] Another fix for Redis schema
* [Fix] Another safe-guards for learning/classifying an empty message
* [Fix] Apply the same workaround for signing keys
* [Fix] Check message before trying to dereference pointer
* [Fix] Do not install doctest stuff
* [Fix] Encode headers that we send to milter add header
* [Fix] Fix DCC `rep` handling
* [Fix] Fix Redis scripts uploading when Redis is not ready
* [Fix] Fix and rework various parts
* [Fix] Fix compatibility with OSSL 1.0
* [Fix] Fix glib internals by setting locale in `rspamc`
* [Fix] GPT: Fix bug in condition check
* [Fix] Get rid of EVP_PKEY_CTX_set1_rsa_keygen_pubexp
* [Fix] Iterate over dynamic keys in fuzzy storage
* [Fix] Make tostring in UCL a bit less brain-damaged
* [Fix] More bogus sizes fix
* [Fix] Preserve the previous behaviour of RDNS_* checks
* [Fix] Rework DMARC to correctly handle spaces in DMARC records Issue: #4906
* [Fix] Sign key != encryption key, omg
* [Fix] Unify lua symbols registration
* [Fix] Use proper keys when doing asymmetric encryption
* [Project] Add API method to push unwrapped UCL object
* [Project] Add more stuff to transparent UCL
* [Project] Add parsing of key limits and expire date
* [Project] Add ratelimit parsing for fuzzy keys
* [Project] Allow manipulations with opaque UCL objects
* [Project] Allow to change log tag from HTTP request
* [Project] Implement expiration
* [Project] Implement per-key ratelimit
* [Project] Move ratelimit parsing stuff to a common library
* [Project] Remove NIST (OpenSSL) mode from cryptobox
* [Project] Remove NIST mode from everywhere
* [Project] Rework ratelimits check
* [Project] Some more fixes
* [Project] Start support of MIME UTF8
* [Project] Try to allow more transparent access of ucl elements
* [Rework] Allow more flexible keypair encoding
* [Rework] Breaking: Rewrite cfg transform and remove legacy
* [Rework] Change fuzzy error symbols
* [Rework] Change the logic of skipping symbols
* [Rework] Clean up legacy code
* [Rework] Implement new replies logic on the server's side
* [Rework] Remove control block support
* [Rework] Resolve rdns in a separate function
* [Rework] Use __builtin_cpu_supports where possible
* [Rework] Use a more straight structure for DKIM keys
* [Rules] Fix some old rules
projects / rspamd.git / log