Apache SpamAssassin

The "make test" rule was fixed when running as
root; this is needed for CPAN. Certain mail input
can take a long time to scan with 100% CPU
utilization, due to backtracking in a rule's
regexp. Sending a HUP signal to the spamd process
causes the ps name to change from spamd to perl.
"make test" errors in Windows caused by
nonportable use of getpwuid were fixed. Multiple
DNS records for a host name should allow use of
spamd -H for load balancing installs to work.
Network lookup timeouts were fixed, where lookups
were being lost once a timeout was hit.

A local user symlink-attack DoS vulnerability
(CVE-2007-2873) was fixed. It only affects systems
where spamd is run as root, is used with vpopmail
or virtual users via the "-v"/"--vpopmail" or
"--virtual-config-dir" switch, and with the
"-x"/"--no-user-config, and without the
"-u"/"--username" switch, and with the
"-l"/"--allow-tell" switch. This is not default on
any distribution package, and is not a common
configuration. Other miscellaneous bugs were also
fixed.

Short-circuiting of "definite ham" or "definite spam" messages based on rules was added. Charset normalization was added, so rules can be written in UTF-8 to match text in other charsets. "sa-compile" was added to compile SpamAssassin rules into a fast parallel-matching DFA. "tflags multiple" was added, which allows rules that count multiple hits in a single message. "whitelist_auth" was added to whitelist addresses that send mail using sender-authorization systems like SPF, Domain Keys, and DKIM. Mail::SpamAssassin::Spamd::Apache2 provides spamd as a mod_perl module.

Fixes were made for a bug in date handling
affecting DATE_IN_FUTURE_* and DATE_IN_PAST_*
rules when more than one Resent-Date header is
present. A race condition in spamd preforking code
that sometimes left one child process running
after sending SIGHUP to spamd was fixed. Hash
characters in the config are now unescaped. False
SPF_SOFTFAILs when SPF queries timeout were fixed.
RCVD_ILLEGAL_IP evaltest was updated to properly
deal with 127/8. Adding headers with a single
digit zero value was enabled. Support for
ecelerity Received headers was added. A bug
introduced in 3.1.5 in mbx code was fixed.

All third-party code is now allowed to use rule
updates by setting a default path when one is not
passed in. Support for whitelisting with
DomainKeys was added. Lots of other minor bugfixes
and documentation updates were done.