Unescaped left brace in regex is deprecated

Bug #1726879 reported by Hassan El Jacifi
52
This bug affects 8 people
Affects Status Importance Assigned to Milestone
spamassassin (Debian)
Fix Released
Unknown
spamassassin (Ubuntu)
Fix Released
Undecided
Unassigned
Trusty
Invalid
Undecided
Unassigned
Xenial
Invalid
Undecided
Unassigned
Artful
Fix Released
Undecided
Unassigned

Bug Description

[Impact]

 * Perl version in Artful complains about deprecated regex usage in
   spamassassin. This works but floods consoles and status mails.

 * Fix is a backport of the small upstream change

[Test Case]

 * simply run sa-learn in any way, for example
     $ sa-learn --help
   In unfixed versions you'll see the following all over the place (also
   on install and in status mails)

     Unescaped left brace in regex is deprecated here (and will be fatal
     in Perl 5.30), passed through in regex; marked by <-- HERE in m/^(.{
     <-- HERE ,200}).*$/ at
     /usr/share/perl5/Mail/SpamAssassin/PerMsgStatus.pm line 923.

 * these should allow someone who is not familiar with the affected
   package to reproduce the bug and verify that the updated package fixes
   the problem.

[Regression Potential]

 * sa-learn worked in some tests, but there could be unexpected
   cases where this breaks by very slight behavior changes.
   OTOH the change is upstream a while now, so the chance it
   really broke anything is low.
   Also the change is essentially 1 chomp moved and 3 pattern matches
   adapted to new syntax - so the amount that slips our review thoughts
   should be low.

[Other Info]

 * n/a

---

When using sa-learn, you receive this notification:

Unescaped left brace in regex is deprecated here (and will be fatal in Perl 5.30), passed through in regex; marked by <-- HERE in m/^(.{ <-- HERE ,200}).*$/ at /usr/share/perl5/Mail/SpamAssassin/PerMsgStatus.pm line 923.

Bug similar to:
https://bugs.archlinux.org/task/54378

Upstream patch to fix the issue:
https://github.com/apache/spamassassin/commit/edb00a8d76a625bf03227ee2f6e915c9a0d90bad.patch

ProblemType: Bug
DistroRelease: Ubuntu 17.10
Package: spamassassin 3.4.1-7
ProcVersionSignature: Ubuntu 4.13.0-16.19-generic 4.13.4
Uname: Linux 4.13.0-16-generic x86_64
NonfreeKernelModules: nvidia_uvm nvidia_drm nvidia_modeset nvidia wl
ApportVersion: 2.20.7-0ubuntu3
Architecture: amd64
CurrentDesktop: GNOME
Date: Tue Oct 24 16:03:14 2017
InstallationDate: Installed on 2012-03-01 (2062 days ago)
InstallationMedia: Ubuntu 11.10 "Oneiric Ocelot" - Release amd64 (20111011)
PackageArchitecture: all
SourcePackage: spamassassin
UpgradeStatus: No upgrade log present (probably fresh install)
modified.conffile..etc.spamassassin.init.pre: [modified]
modified.conffile..etc.spamassassin.v310.pre: [modified]
modified.conffile..etc.spamassassin.v312.pre: [modified]
modified.conffile..etc.spamassassin.v330.pre: [modified]
modified.conffile..etc.spamassassin.v340.pre: [modified]
modified.conffile..etc.spamassassin.v341.pre: [modified]
mtime.conffile..etc.default.spamassassin: 2017-08-07T14:05:53.351115
mtime.conffile..etc.spamassassin.init.pre: 2012-03-03T17:13:34.827338
mtime.conffile..etc.spamassassin.v310.pre: 2012-03-03T17:16:33.359340
mtime.conffile..etc.spamassassin.v312.pre: 2012-03-03T17:17:26.667341
mtime.conffile..etc.spamassassin.v330.pre: 2012-03-03T17:17:53.215342
mtime.conffile..etc.spamassassin.v340.pre: 2014-07-10T16:07:25.307684
mtime.conffile..etc.spamassassin.v341.pre: 2016-11-12T12:43:21.082704

Revision history for this message
Hassan El Jacifi (waver) wrote :
Revision history for this message
Hassan El Jacifi (waver) wrote :

16:34 waver@Jupiter ~% sa-learn --help
Unescaped left brace in regex is deprecated here (and will be fatal in Perl 5.30), passed through in regex; marked by <-- HERE in m/^(.{ <-- HERE ,200}).*$/ at /usr/share/perl5/Mail/SpamAssassin/PerMsgStatus.pm line 923.
SpamAssassin version 3.4.1
For more information read the manual page
Usage:
    sa-learn [options] [file]...

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in spamassassin (Ubuntu):
status: New → Confirmed
Changed in spamassassin (Debian):
status: Unknown → Fix Released
Revision history for this message
Jon Ribbens (jribbens-r) wrote :

Any news on when this bugfix will be applied to Ubuntu? It is presumably affecting all Ubuntu users of SpamAssassin.

Revision history for this message
Firas Kraïem (firas) wrote :

It will be applied when someone is willing and able to do it. I suppose I'll be able to find some time towards the end of the month, if no one does it before.

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

This was fixed in 3.4.1-8 which is synced into the upcoming Ubuntu bionic already.
@Firas - are you looking forward to proposed something for SRUs into released Ubuntu versions?

Changed in spamassassin (Ubuntu):
status: Confirmed → Fix Released
Revision history for this message
Firas Kraïem (firas) wrote :

IMO this should definitely be a SRU, yes, especially since sa-learn is called daily in a cron job, so you get this warning in your e-mail inbox every day.

Revision history for this message
Alexander List (alexlist) wrote :

+1 for a SRU.

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

I added Tasks for T/X/Z/A to consider SRUs but would leave it to you experts and Firas as volunteer to take a look where it applies and makes sense to do so.

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in spamassassin (Ubuntu Artful):
status: New → Confirmed
Changed in spamassassin (Ubuntu Trusty):
status: New → Confirmed
Changed in spamassassin (Ubuntu Xenial):
status: New → Confirmed
Changed in spamassassin (Ubuntu Zesty):
status: New → Confirmed
Revision history for this message
Laurent Simon (stratic) wrote :

In this case, SRU is not "to be considered", it is imperative. Every day, cron daily jobs sends notifications for this bug. With lot of servers to administer, it's mailbox flooding...

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

I agree Laurent, I meant it more as an ordering as implied by the SRU policy to have it in the latest release and then go for SRUs.

Firas are you still up to do that (I don't want to reject any community help) or should I give it a shot?

tags: added: server-next
Changed in spamassassin (Ubuntu Trusty):
status: Confirmed → Triaged
Changed in spamassassin (Ubuntu Xenial):
status: Confirmed → Triaged
Changed in spamassassin (Ubuntu Zesty):
status: Confirmed → Triaged
Changed in spamassassin (Ubuntu Artful):
status: Confirmed → Triaged
no longer affects: spamassassin (Ubuntu Zesty)
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

I didn't really want to take anything away from volunteers, but this is a low hanging fruit fix - so I prepped a few MPs to review.

I need to run ppa's for those and add an SRU template still, but I wanted to push these to be seen and ready for review already.

Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

This actually doesn't affect T/X as the pearl there is older and does not complain.
Thanks Ahasenack for spotting this before I started to build all the test ppa's!

Changed in spamassassin (Ubuntu Xenial):
status: Triaged → Invalid
Changed in spamassassin (Ubuntu Trusty):
status: Triaged → Invalid
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

uploaded and ready for the SRU Teams review

description: updated
Revision history for this message
Chris J Arges (arges) wrote : Please test proposed package

Hello Hassan, or anyone else affected,

Accepted spamassassin into artful-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/spamassassin/3.4.1-7ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-artful to verification-done-artful. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-artful. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in spamassassin (Ubuntu Artful):
status: Triaged → Fix Committed
tags: added: verification-needed verification-needed-artful
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

In Artful I ran:
 $ sa-learn --help # still triggered the bug
 $ vim /etc/apt/sources.list # Enable proposed
 $ apt update
 $ apt install spamassassin
 $ sa-learn --help # issue fixed

tags: added: verification-done verification-done-artful
removed: verification-needed verification-needed-artful
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package spamassassin - 3.4.1-7ubuntu1

---------------
spamassassin (3.4.1-7ubuntu1) artful; urgency=medium

  * Apply upstream patch to fix regex error leading to warnings in
    perl 5.26+ (Closes: 869408) (LP: #1726879)

 -- Christian Ehrhardt <email address hidden> Tue, 23 Jan 2018 17:00:08 +0100

Changed in spamassassin (Ubuntu Artful):
status: Fix Committed → Fix Released
Revision history for this message
Łukasz Zemczak (sil2100) wrote : Update Released

The verification of the Stable Release Update for spamassassin has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.