Repository: Mailu/Mailu

Issue:
Vulnerability in ClamAV

## Environment & Version

### Environment

- [ ] docker compose
- [x] kubernetes
- [ ] docker swarm

### Version

- Version: `master`

## Description
ClamAV version 0.105.2 is vulnerable to [CVE-2023-20197](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20197)
Unfortunately, ClamAV will not provide any update in the 0.105 branch, as it is EOL see https://blog.clamav.net/2023/07/2023-08-16-releases.html

## Replication Steps
```
$ docker run --pull=always --rm -it ghcr.io/mailu/clamav:master clamd --version
master: Pulling from mailu/clamav
Digest: sha256:dd088fc80ab063b0588160a69fce034d5d1f33db6d85d57296154fc51cdeaffa
Status: Image is up to date for ghcr.io/mailu/clamav:master
ClamAV 0.105.2
```

## Observed behaviour
ClamAV is in a vulnerable state

## Expected behaviour
I expect ClamAV to be updated to a fixed version (1.1.1 or 1.0.2)




Discussion:
It looks like the base image should be updated to Alpine 3.18. As seen [here](https://pkgs.alpinelinux.org/packages?name=clamav&branch=v3.18&repo=&arch=&maintainer=), it allows to install ClamAV 1.1.0
Yeah well for master the fix is quite straightforward... I'm not sure we want to backport a switch of the base image though ;)
So how do we progress this? Has someone filled in a ticket with Alpine so that we get the fix backported to 3.17?
> Yeah well for master the fix is quite straightforward... I'm not sure we want to backport a switch of the base image though ;)

Yes, I agree to that. Updating Alpine in the base might also bump the versions of other installed packages.

> So how do we progress this? Has someone filled in a ticket with Alpine so that we get the fix backported to 3.17?

I'm not sure what the policy of Alpine is about backporting this. @cpernot-hf mentioned ClamAV 0.105 is EOL, so the backport will mean a completely different version.


Maybe `docker sbom` could provide some insights in all of the installed packages on the Mailu container images. This could then be compared with the versions of Alpine 3.18 to get a better overview of the changes and if it might be feasible to update the Alpine version non the less.
3.17 is "stable" and security-supported until end of 2024 according to https://alpinelinux.org/releases/

My suggestion is to log a ticket with them and see what they say. They may be able to backport just the fix or the full package.
I've filed a backport ticket to the alpine aport repository - https://gitlab.alpinelinux.org/alpine/aports/-/issues/15249
I've filed a backport ticket to the alpine aport repository - https://gitlab.alpinelinux.org/alpine/aports/-/issues/15249
@dasrecht thank you.

I suggest you highlight the CVE/vulnerability on the ticket otherwise it will be ignored.
Good point, added that to the ticket - Thanks
Added that - The answer is clear and in line with the alpine release schedules - `community repository is supported until next stable release` 

So from an alpine standpoint, there's only the possibility to move the base image to 3.18. I am unsure what the stance of Mailu on this is. 
I think it would also be worth looking into using the official ClamAV container image, which is maintained regularly - but I also understand that there might be considerations of not going with an official image.
Ok, i've looked a bit into this - It should be fairly easy to move to alpine 3.18 and a first short test shows that this would also work.

```
docker run -it clamav-test clamd --version
ClamAV 1.1.2
```

Will wrap that into a MR tomorrow morning
I am definitely in favour of going with upstream's image.

I do not consider switching the base image of the release to be an option we could backport.

The CVE here is about a DoS: something low risk that few people care about outside of the context of email gateways.
I agree on the low-risk CVE - I see it more as a problem that the version of ClamAV shipped with Alpine 3.17 is [EOL](https://blog.clamav.net/2023/07/2023-08-16-releases.html) - so whatever gets patched in newer versions will become an issue on the old release.

Is there a planned update of the base image at some point? As 3.17 is only getting security fixes.

If I find some time in the coming days I'll have a look if there's a way to use the official images.

Resolving patch:
diff --git a/core/rspamd/start.py b/core/rspamd/start.py
--- a/core/rspamd/start.py
+++ b/core/rspamd/start.py
@@ -37,4 +37,4 @@
 os.system("mkdir -m 755 -p /run/rspamd")
 os.system("chown rspamd:rspamd /run/rspamd")
 os.system("find /var/lib/rspamd | grep -v /filter | xargs -n1 chown rspamd:rspamd")
-os.execv("/usr/sbin/rspamd", ["rspamd", "-f", "-u", "rspamd", "-g", "rspamd"])
+os.execv("/usr/bin/rspamd", ["rspamd", "-f", "-u", "rspamd", "-g", "rspamd"])


Test patch: