Description
Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.
Remediation
References
https://github.com/outflanknl/Exploits/blob/master/harakiri-CVE-2016-1000282.py
Related Vulnerabilities
CVE-2022-41401 Vulnerability in maven package org.openrefine:main
CVE-2022-0853 Vulnerability in maven package jboss:jboss-client
CVE-2020-13410 Vulnerability in npm package aedes
CVE-2021-44832 Vulnerability in maven package org.apache.logging.log4j:log4j-core
CVE-2013-2254 Vulnerability in maven package org.apache.sling:org.apache.sling.servlets.post