Description
Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.
Remediation
References
https://github.com/outflanknl/Exploits/blob/master/harakiri-CVE-2016-1000282.py
Related Vulnerabilities
CVE-2022-21126 Vulnerability in maven package com.github.samtools:htsjdk
CVE-2017-16187 Vulnerability in npm package open-device
CVE-2022-31183 Vulnerability in maven package co.fs2:fs2-io_sjs1_3
CVE-2023-47324 Vulnerability in maven package org.silverpeas.core:silverpeas-core-web
CVE-2015-1833 Vulnerability in maven package org.apache.jackrabbit:jackrabbit-webdav