Description
Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.
Remediation
References
https://github.com/outflanknl/Exploits/blob/master/harakiri-CVE-2016-1000282.py
Related Vulnerabilities
CVE-2022-36916 Vulnerability in maven package org.jenkins-ci.plugins:google-cloud-backup
CVE-2022-21803 Vulnerability in npm package nconf
CVE-2022-25852 Vulnerability in npm package pg-native
CVE-2022-0654 Vulnerability in npm package requestretry
CVE-2022-28220 Vulnerability in maven package org.apache.james:james-server-protocols-managesieve