Page History

...

If you have the SpamAssassin source tree, well and good. If you got it from something like an RPM somewhere that did not include source, get the corresponding source or fetch Razor2.patch from http://www.spamassassin.org/released/Razor2.patch

Note: if you are using the official SpamAssassin RPMs, the Razor2.patch file is located in your documentation directory, usually /usr/share/doc/spamassassin-<version>.

See README and Razor2.patch in the source:

...

To verify your version of Razor, use: razor-admin -v

BR This should respond with something similar to: Razor Agents 2.36, protocol version 3BR

With a clean copy of razor-agents-2.36 expect to see the following output from patch:

...

but no rejects. If you see rejects you're probably looking at a previously patched or modified Razor2.

Razor 2.37 may contain these fixes. 40 contains these fixes already. The Changes file says "Applied patch from Mark Martinec and Vivek Khera of Amavid to untaint various file targets obtained from user input. This is the same patch pointed to by the SpamAssassin FAQ http://www.spamassassin.org/released/Razor2.patch"