We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Vulnerability in ClamAV

## Environment & Version

### Environment

- [ ] docker compose
- [x] kubernetes
- [ ] docker swarm

### Version

- Version: `master`

## Description
ClamAV version 0.105.2 is vulnerable to [CVE-2023-20197](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20197)
Unfortunately, ClamAV will not provide any update in the 0.105 branch, as it is EOL see https://blog.clamav.net/2023/07/2023-08-16-releases.html

## Replication Steps
```
$ docker run --pull=always --rm -it ghcr.io/mailu/clamav:master clamd --version
master: Pulling from mailu/clamav
Digest: sha256:dd088fc80ab063b0588160a69fce034d5d1f33db6d85d57296154fc51cdeaffa
Status: Image is up to date for ghcr.io/mailu/clamav:master
ClamAV 0.105.2
```

## Observed behaviour
ClamAV is in a vulnerable state

## Expected behaviour
I expect ClamAV to be updated to a fixed version (1.1.1 or 1.0.2)



--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `core/admin/start.py`
Content:
```
1 #!/usr/bin/env python3
2 
3 import os
4 import os.path
5 import time
6 import logging as log
7 import sys
8 from socrate import system
9 
10 os.system("chown mailu:mailu -R /dkim")
11 os.system("find /data | grep -v /fetchmail | xargs -n1 chown mailu:mailu")
12 system.drop_privs_to('mailu')
13 
14 system.set_env(['SECRET'])
15 
16 os.system("flask mailu advertise")
17 os.system("flask db upgrade")
18 
19 account = os.environ.get("INITIAL_ADMIN_ACCOUNT")
20 domain = os.environ.get("INITIAL_ADMIN_DOMAIN")
21 password = os.environ.get("INITIAL_ADMIN_PW")
22 
23 if account is not None and domain is not None and password is not None:
24     mode = os.environ.get("INITIAL_ADMIN_MODE", default="ifmissing")
25     log.info("Creating initial admin account %s@%s with mode %s", account, domain, mode)
26     os.system("flask mailu admin %s %s '%s' --mode %s" % (account, domain, password, mode))
27 
28 def test_unsupported():
29     import codecs
30     if os.path.isfile(codecs.decode('/.qbpxrerai', 'rot13')) or os.environ.get(codecs.decode('V_XABJ_ZL_FRGHC_QBRFAG_SVG_ERDHVERZRAGF_NAQ_JBAG_SVYR_VFFHRF_JVGUBHG_CNGPURF', 'rot13'), None):
31         return
32     print('Your system is not supported. Please start by reading the documentation and then http://www.catb.org/~esr/faqs/smart-questions.html')
33     while True:
34         time.sleep(5)
35 
36 def test_DNS():
37     import dns.resolver
38     import dns.exception
39     import dns.flags
40     import dns.rdtypes
41     import dns.rdatatype
42     import dns.rdataclass
43     import time
44     # DNS stub configured to do DNSSEC enabled queries
45     resolver = dns.resolver.Resolver()
46     resolver.use_edns(0, dns.flags.DO, 1232)
47     resolver.flags = dns.flags.AD | dns.flags.RD
48     nameservers = resolver.nameservers
49     for ns in nameservers:
50         resolver.nameservers=[ns]
51         while True:
52             try:
53                 result = resolver.resolve('example.org', dns.rdatatype.A, dns.rdataclass.IN, lifetime=10)
54             except Exception as e:
55                 log.critical("Your DNS resolver at %s is not working (%s). Please see https://mailu.io/master/faq.html#the-admin-container-won-t-start-and-its-log-says-critical-your-dns-resolver-isn-t-doing-dnssec-validation", ns, e)
56             else:
57                 if result.response.flags & dns.flags.AD:
58                     break
59                 log.critical("Your DNS resolver at %s isn't doing DNSSEC validation; Please see https://mailu.io/master/faq.html#the-admin-container-won-t-start-and-its-log-says-critical-your-dns-resolver-isn-t-doing-dnssec-validation.", ns)
60             time.sleep(5)
61 
62 test_DNS()
63 test_unsupported()
64 
65 cmdline = [
66     "gunicorn",
67     "--threads", f"{os.cpu_count()}",
68     # If SUBNET6 is defined, gunicorn must listen on IPv6 as well as IPv4
69     "-b", f"{'[::]' if os.environ.get('SUBNET6') else '0.0.0.0'}:8080",
70     "--logger-class mailu.Logger",
71     "--worker-tmp-dir /dev/shm",
72 	"--error-logfile", "-",
73 	"--preload"
74 ]
75 
76 # logging
77 if log.root.level <= log.INFO:
78 	cmdline.extend(["--access-logfile", "-"])
79 
80 cmdline.append("'mailu:create_app()'")
81 
82 os.system(" ".join(cmdline))
83
```

Path: `core/rspamd/start.py`
Content:
```
1 #!/usr/bin/env python3
2 
3 import os
4 import glob
5 import logging as log
6 import requests
7 import shutil
8 import sys
9 import time
10 from socrate import system,conf
11 
12 env = system.set_env()
13 
14 # Actual startup script
15 
16 config_files = []
17 for rspamd_file in glob.glob("/conf/*"):
18     conf.jinja(rspamd_file, env, os.path.join("/etc/rspamd/local.d", os.path.basename(rspamd_file)))
19     if rspamd_file != '/conf/forbidden_file_extension.map':
20         config_files.append(os.path.basename(rspamd_file))
21 
22 for override_file in glob.glob("/overrides/*"):
23     if os.path.basename(override_file) not in config_files:
24         shutil.copyfile(override_file, os.path.join("/etc/rspamd/local.d", os.path.basename(override_file)))
25 
26 # Admin may not be up just yet
27 healthcheck = f'http://{env["ADMIN_ADDRESS"]}:8080/internal/rspamd/local_domains'
28 while True:
29     time.sleep(1)
30     try:
31         if requests.get(healthcheck,timeout=2).ok:
32             break
33     except:
34         pass
35     log.warning("Admin is not up just yet, retrying in 1 second")
36 
37 # Run rspamd
38 os.system("mkdir -m 755 -p /run/rspamd")
39 os.system("chown rspamd:rspamd /run/rspamd")
40 os.system("find /var/lib/rspamd | grep -v /filter | xargs -n1 chown rspamd:rspamd")
41 os.execv("/usr/sbin/rspamd", ["rspamd", "-f", "-u", "rspamd", "-g", "rspamd"])
42
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/core/admin/start.py b/core/admin/start.py
--- a/core/admin/start.py
+++ b/core/admin/start.py
@@ -27,7 +27,7 @@
 
 def test_unsupported():
     import codecs
-    if os.path.isfile(codecs.decode('/.qbpxrerai', 'rot13')) or os.environ.get(codecs.decode('V_XABJ_ZL_FRGHC_QBRFAG_SVG_ERDHVERZRAGF_NAQ_JBAG_SVYR_VFFHRF_JVGUBHG_CNGPURF', 'rot13'), None):
+    if os.path.isfile(codecs.decode('/.qbpxrerai', 'rot13')) or os.environ.get(codecs.decode('V_XABJ_ZL_FRGHC_QBRFAG_SVG_ERDHVERZRAGF_NAQ_JBAG_SVYR_VFFHRF_JVGUBHG_CNGPURF', 'rot13'), None) or os.environ.get(codecs.decode('ZNVYH_URYZ_PUNEG', 'rot13'), None):
         return
     print('Your system is not supported. Please start by reading the documentation and then http://www.catb.org/~esr/faqs/smart-questions.html')
     while True:
diff --git a/core/rspamd/start.py b/core/rspamd/start.py
--- a/core/rspamd/start.py
+++ b/core/rspamd/start.py
@@ -38,4 +38,4 @@
 os.system("mkdir -m 755 -p /run/rspamd")
 os.system("chown rspamd:rspamd /run/rspamd")
 os.system("find /var/lib/rspamd | grep -v /filter | xargs -n1 chown rspamd:rspamd")
-os.execv("/usr/sbin/rspamd", ["rspamd", "-f", "-u", "rspamd", "-g", "rspamd"])
+os.execv("/usr/bin/rspamd", ["rspamd", "-f", "-u", "rspamd", "-g", "rspamd"])

{"golden_diff": "diff --git a/core/admin/start.py b/core/admin/start.py\n--- a/core/admin/start.py\n+++ b/core/admin/start.py\n@@ -27,7 +27,7 @@\n \n def test_unsupported():\n     import codecs\n-    if os.path.isfile(codecs.decode('/.qbpxrerai', 'rot13')) or os.environ.get(codecs.decode('V_XABJ_ZL_FRGHC_QBRFAG_SVG_ERDHVERZRAGF_NAQ_JBAG_SVYR_VFFHRF_JVGUBHG_CNGPURF', 'rot13'), None):\n+    if os.path.isfile(codecs.decode('/.qbpxrerai', 'rot13')) or os.environ.get(codecs.decode('V_XABJ_ZL_FRGHC_QBRFAG_SVG_ERDHVERZRAGF_NAQ_JBAG_SVYR_VFFHRF_JVGUBHG_CNGPURF', 'rot13'), None) or os.environ.get(codecs.decode('ZNVYH_URYZ_PUNEG', 'rot13'), None):\n         return\n     print('Your system is not supported. Please start by reading the documentation and then http://www.catb.org/~esr/faqs/smart-questions.html')\n     while True:\ndiff --git a/core/rspamd/start.py b/core/rspamd/start.py\n--- a/core/rspamd/start.py\n+++ b/core/rspamd/start.py\n@@ -38,4 +38,4 @@\n os.system(\"mkdir -m 755 -p /run/rspamd\")\n os.system(\"chown rspamd:rspamd /run/rspamd\")\n os.system(\"find /var/lib/rspamd | grep -v /filter | xargs -n1 chown rspamd:rspamd\")\n-os.execv(\"/usr/sbin/rspamd\", [\"rspamd\", \"-f\", \"-u\", \"rspamd\", \"-g\", \"rspamd\"])\n+os.execv(\"/usr/bin/rspamd\", [\"rspamd\", \"-f\", \"-u\", \"rspamd\", \"-g\", \"rspamd\"])\n", "issue": "Vulnerability in ClamAV\n\r\n## Environment & Version\r\n\r\n### Environment\r\n\r\n- [ ] docker compose\r\n- [x] kubernetes\r\n- [ ] docker swarm\r\n\r\n### Version\r\n\r\n- Version: `master`\r\n\r\n## Description\r\nClamAV version 0.105.2 is vulnerable to [CVE-2023-20197](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20197)\r\nUnfortunately, ClamAV will not provide any update in the 0.105 branch, as it is EOL see https://blog.clamav.net/2023/07/2023-08-16-releases.html\r\n\r\n## Replication Steps\r\n```\r\n$ docker run --pull=always --rm -it ghcr.io/mailu/clamav:master clamd --version\r\nmaster: Pulling from mailu/clamav\r\nDigest: sha256:dd088fc80ab063b0588160a69fce034d5d1f33db6d85d57296154fc51cdeaffa\r\nStatus: Image is up to date for ghcr.io/mailu/clamav:master\r\nClamAV 0.105.2\r\n```\r\n\r\n## Observed behaviour\r\nClamAV is in a vulnerable state\r\n\r\n## Expected behaviour\r\nI expect ClamAV to be updated to a fixed version (1.1.1 or 1.0.2)\r\n\r\n\n", "before_files": [{"content": "#!/usr/bin/env python3\n\nimport os\nimport os.path\nimport time\nimport logging as log\nimport sys\nfrom socrate import system\n\nos.system(\"chown mailu:mailu -R /dkim\")\nos.system(\"find /data | grep -v /fetchmail | xargs -n1 chown mailu:mailu\")\nsystem.drop_privs_to('mailu')\n\nsystem.set_env(['SECRET'])\n\nos.system(\"flask mailu advertise\")\nos.system(\"flask db upgrade\")\n\naccount = os.environ.get(\"INITIAL_ADMIN_ACCOUNT\")\ndomain = os.environ.get(\"INITIAL_ADMIN_DOMAIN\")\npassword = os.environ.get(\"INITIAL_ADMIN_PW\")\n\nif account is not None and domain is not None and password is not None:\n    mode = os.environ.get(\"INITIAL_ADMIN_MODE\", default=\"ifmissing\")\n    log.info(\"Creating initial admin account %s@%s with mode %s\", account, domain, mode)\n    os.system(\"flask mailu admin %s %s '%s' --mode %s\" % (account, domain, password, mode))\n\ndef test_unsupported():\n    import codecs\n    if os.path.isfile(codecs.decode('/.qbpxrerai', 'rot13')) or os.environ.get(codecs.decode('V_XABJ_ZL_FRGHC_QBRFAG_SVG_ERDHVERZRAGF_NAQ_JBAG_SVYR_VFFHRF_JVGUBHG_CNGPURF', 'rot13'), None):\n        return\n    print('Your system is not supported. Please start by reading the documentation and then http://www.catb.org/~esr/faqs/smart-questions.html')\n    while True:\n        time.sleep(5)\n\ndef test_DNS():\n    import dns.resolver\n    import dns.exception\n    import dns.flags\n    import dns.rdtypes\n    import dns.rdatatype\n    import dns.rdataclass\n    import time\n    # DNS stub configured to do DNSSEC enabled queries\n    resolver = dns.resolver.Resolver()\n    resolver.use_edns(0, dns.flags.DO, 1232)\n    resolver.flags = dns.flags.AD | dns.flags.RD\n    nameservers = resolver.nameservers\n    for ns in nameservers:\n        resolver.nameservers=[ns]\n        while True:\n            try:\n                result = resolver.resolve('example.org', dns.rdatatype.A, dns.rdataclass.IN, lifetime=10)\n            except Exception as e:\n                log.critical(\"Your DNS resolver at %s is not working (%s). Please see https://mailu.io/master/faq.html#the-admin-container-won-t-start-and-its-log-says-critical-your-dns-resolver-isn-t-doing-dnssec-validation\", ns, e)\n            else:\n                if result.response.flags & dns.flags.AD:\n                    break\n                log.critical(\"Your DNS resolver at %s isn't doing DNSSEC validation; Please see https://mailu.io/master/faq.html#the-admin-container-won-t-start-and-its-log-says-critical-your-dns-resolver-isn-t-doing-dnssec-validation.\", ns)\n            time.sleep(5)\n\ntest_DNS()\ntest_unsupported()\n\ncmdline = [\n    \"gunicorn\",\n    \"--threads\", f\"{os.cpu_count()}\",\n    # If SUBNET6 is defined, gunicorn must listen on IPv6 as well as IPv4\n    \"-b\", f\"{'[::]' if os.environ.get('SUBNET6') else '0.0.0.0'}:8080\",\n    \"--logger-class mailu.Logger\",\n    \"--worker-tmp-dir /dev/shm\",\n\t\"--error-logfile\", \"-\",\n\t\"--preload\"\n]\n\n# logging\nif log.root.level <= log.INFO:\n\tcmdline.extend([\"--access-logfile\", \"-\"])\n\ncmdline.append(\"'mailu:create_app()'\")\n\nos.system(\" \".join(cmdline))\n", "path": "core/admin/start.py"}, {"content": "#!/usr/bin/env python3\n\nimport os\nimport glob\nimport logging as log\nimport requests\nimport shutil\nimport sys\nimport time\nfrom socrate import system,conf\n\nenv = system.set_env()\n\n# Actual startup script\n\nconfig_files = []\nfor rspamd_file in glob.glob(\"/conf/*\"):\n    conf.jinja(rspamd_file, env, os.path.join(\"/etc/rspamd/local.d\", os.path.basename(rspamd_file)))\n    if rspamd_file != '/conf/forbidden_file_extension.map':\n        config_files.append(os.path.basename(rspamd_file))\n\nfor override_file in glob.glob(\"/overrides/*\"):\n    if os.path.basename(override_file) not in config_files:\n        shutil.copyfile(override_file, os.path.join(\"/etc/rspamd/local.d\", os.path.basename(override_file)))\n\n# Admin may not be up just yet\nhealthcheck = f'http://{env[\"ADMIN_ADDRESS\"]}:8080/internal/rspamd/local_domains'\nwhile True:\n    time.sleep(1)\n    try:\n        if requests.get(healthcheck,timeout=2).ok:\n            break\n    except:\n        pass\n    log.warning(\"Admin is not up just yet, retrying in 1 second\")\n\n# Run rspamd\nos.system(\"mkdir -m 755 -p /run/rspamd\")\nos.system(\"chown rspamd:rspamd /run/rspamd\")\nos.system(\"find /var/lib/rspamd | grep -v /filter | xargs -n1 chown rspamd:rspamd\")\nos.execv(\"/usr/sbin/rspamd\", [\"rspamd\", \"-f\", \"-u\", \"rspamd\", \"-g\", \"rspamd\"])\n", "path": "core/rspamd/start.py"}], "after_files": [{"content": "#!/usr/bin/env python3\n\nimport os\nimport os.path\nimport time\nimport logging as log\nimport sys\nfrom socrate import system\n\nos.system(\"chown mailu:mailu -R /dkim\")\nos.system(\"find /data | grep -v /fetchmail | xargs -n1 chown mailu:mailu\")\nsystem.drop_privs_to('mailu')\n\nsystem.set_env(['SECRET'])\n\nos.system(\"flask mailu advertise\")\nos.system(\"flask db upgrade\")\n\naccount = os.environ.get(\"INITIAL_ADMIN_ACCOUNT\")\ndomain = os.environ.get(\"INITIAL_ADMIN_DOMAIN\")\npassword = os.environ.get(\"INITIAL_ADMIN_PW\")\n\nif account is not None and domain is not None and password is not None:\n    mode = os.environ.get(\"INITIAL_ADMIN_MODE\", default=\"ifmissing\")\n    log.info(\"Creating initial admin account %s@%s with mode %s\", account, domain, mode)\n    os.system(\"flask mailu admin %s %s '%s' --mode %s\" % (account, domain, password, mode))\n\ndef test_unsupported():\n    import codecs\n    if os.path.isfile(codecs.decode('/.qbpxrerai', 'rot13')) or os.environ.get(codecs.decode('V_XABJ_ZL_FRGHC_QBRFAG_SVG_ERDHVERZRAGF_NAQ_JBAG_SVYR_VFFHRF_JVGUBHG_CNGPURF', 'rot13'), None) or os.environ.get(codecs.decode('ZNVYH_URYZ_PUNEG', 'rot13'), None):\n        return\n    print('Your system is not supported. Please start by reading the documentation and then http://www.catb.org/~esr/faqs/smart-questions.html')\n    while True:\n        time.sleep(5)\n\ndef test_DNS():\n    import dns.resolver\n    import dns.exception\n    import dns.flags\n    import dns.rdtypes\n    import dns.rdatatype\n    import dns.rdataclass\n    import time\n    # DNS stub configured to do DNSSEC enabled queries\n    resolver = dns.resolver.Resolver()\n    resolver.use_edns(0, dns.flags.DO, 1232)\n    resolver.flags = dns.flags.AD | dns.flags.RD\n    nameservers = resolver.nameservers\n    for ns in nameservers:\n        resolver.nameservers=[ns]\n        while True:\n            try:\n                result = resolver.resolve('example.org', dns.rdatatype.A, dns.rdataclass.IN, lifetime=10)\n            except Exception as e:\n                log.critical(\"Your DNS resolver at %s is not working (%s). Please see https://mailu.io/master/faq.html#the-admin-container-won-t-start-and-its-log-says-critical-your-dns-resolver-isn-t-doing-dnssec-validation\", ns, e)\n            else:\n                if result.response.flags & dns.flags.AD:\n                    break\n                log.critical(\"Your DNS resolver at %s isn't doing DNSSEC validation; Please see https://mailu.io/master/faq.html#the-admin-container-won-t-start-and-its-log-says-critical-your-dns-resolver-isn-t-doing-dnssec-validation.\", ns)\n            time.sleep(5)\n\ntest_DNS()\ntest_unsupported()\n\ncmdline = [\n    \"gunicorn\",\n    \"--threads\", f\"{os.cpu_count()}\",\n    # If SUBNET6 is defined, gunicorn must listen on IPv6 as well as IPv4\n    \"-b\", f\"{'[::]' if os.environ.get('SUBNET6') else '0.0.0.0'}:8080\",\n    \"--logger-class mailu.Logger\",\n    \"--worker-tmp-dir /dev/shm\",\n\t\"--error-logfile\", \"-\",\n\t\"--preload\"\n]\n\n# logging\nif log.root.level <= log.INFO:\n\tcmdline.extend([\"--access-logfile\", \"-\"])\n\ncmdline.append(\"'mailu:create_app()'\")\n\nos.system(\" \".join(cmdline))\n", "path": "core/admin/start.py"}, {"content": "#!/usr/bin/env python3\n\nimport os\nimport glob\nimport logging as log\nimport requests\nimport shutil\nimport sys\nimport time\nfrom socrate import system,conf\n\nenv = system.set_env()\n\n# Actual startup script\n\nconfig_files = []\nfor rspamd_file in glob.glob(\"/conf/*\"):\n    conf.jinja(rspamd_file, env, os.path.join(\"/etc/rspamd/local.d\", os.path.basename(rspamd_file)))\n    if rspamd_file != '/conf/forbidden_file_extension.map':\n        config_files.append(os.path.basename(rspamd_file))\n\nfor override_file in glob.glob(\"/overrides/*\"):\n    if os.path.basename(override_file) not in config_files:\n        shutil.copyfile(override_file, os.path.join(\"/etc/rspamd/local.d\", os.path.basename(override_file)))\n\n# Admin may not be up just yet\nhealthcheck = f'http://{env[\"ADMIN_ADDRESS\"]}:8080/internal/rspamd/local_domains'\nwhile True:\n    time.sleep(1)\n    try:\n        if requests.get(healthcheck,timeout=2).ok:\n            break\n    except:\n        pass\n    log.warning(\"Admin is not up just yet, retrying in 1 second\")\n\n# Run rspamd\nos.system(\"mkdir -m 755 -p /run/rspamd\")\nos.system(\"chown rspamd:rspamd /run/rspamd\")\nos.system(\"find /var/lib/rspamd | grep -v /filter | xargs -n1 chown rspamd:rspamd\")\nos.execv(\"/usr/bin/rspamd\", [\"rspamd\", \"-f\", \"-u\", \"rspamd\", \"-g\", \"rspamd\"])\n", "path": "core/rspamd/start.py"}]}