Merge ~mitchdz/ubuntu/+source/spamassassin:fix-spamassassin-focal into ubuntu/+source/spamassassin:ubuntu/focal-devel

[Mitchell Dzurick]

PPA:https://launchpad.net/~mitchdz/+archive/ubuntu/fix-spamassassin

[Lena Voytek (lvoytek)]

LGTM

review: Approve

[Lena Voytek (lvoytek)]

dput ubuntu spamassassin_3.4.4-1ubuntu1.2_source.changes
D: Setting host argument.
Checking signature on .changes
gpg: /home/lena/git/spamassassin/spamassassin_3.4.4-1ubuntu1.2_source.changes: Valid signature from 34B8AD7D9529E793
Checking signature on .dsc
gpg: /home/lena/git/spamassassin/spamassassin_3.4.4-1ubuntu1.2.dsc: Valid signature from 34B8AD7D9529E793
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading spamassassin_3.4.4-1ubuntu1.2.dsc: done.
  Uploading spamassassin_3.4.4-1ubuntu1.2.debian.tar.xz: done.
  Uploading spamassassin_3.4.4-1ubuntu1.2_source.buildinfo: done.
  Uploading spamassassin_3.4.4-1ubuntu1.2_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index 010ed3d..44d29f3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+spamassassin (3.4.4-1ubuntu1.2) focal; urgency=medium
+
+  * d/p/fix-mkpath-untainted.patch: fix spamd running with virtual-config-dir
+    mkdir error (LP: #1799185)
+
+ -- Mitchell Dzurick <[e-mail]>  Fri, 24 Mar 2023 09:36:49 -0700
+
 spamassassin (3.4.4-1ubuntu1.1) focal-security; urgency=medium
 
   * SECURITY UPDATE: OS Command Injection in cf file parsing
diff --git a/debian/patches/fix-mkpath-untainted.patch b/debian/patches/fix-mkpath-untainted.patch
new file mode 100644
index 0000000..11f7a1f
--- /dev/null
+++ b/debian/patches/fix-mkpath-untainted.patch
@@ -0,0 +1,20 @@
+Description: fix spamd running with virtual-config-dir mkdir error
+Author: Henrik Krohns <[e-mail]>
+Origin: upstream, https://github.com/apache/spamassassin/commit/bdf77b263d3d52c8c3abff8865aeb1648ff292c0
+Bug: https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7646
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/spamassassin/+bug/1799185
+Forwarded: not-needed
+Last-Update: 2023-03-23
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/lib/Mail/SpamAssassin.pm
++++ b/lib/Mail/SpamAssassin.pm
+@@ -1900,7 +1900,7 @@
+     dbg("config: error accessing $fname: $!");
+   } else {  # does not exist, create it
+     eval {
+-      mkpath($fname, 0, 0700);  1;
++      mkpath(Mail::SpamAssassin::Util::untaint_file_path($fname), 0, 0700);  1;
+     } or do {
+       my $eval_stat = $@ ne '' ? $@ : "errno=$!";  chomp $eval_stat;
+       dbg("config: mkdir $fname failed: $eval_stat");
diff --git a/debian/patches/series b/debian/patches/series
index 35716a9..4f7d642 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -8,3 +8,4 @@ debian_gitignore
 bug426031-pod-fix
 skip_config_tree_recurse_test
 CVE-2020-1946.patch
+fix-mkpath-untainted.patch