spamassassin: CVE-2020-1946: arbitrary code execution via malicious rule configuration files

Debian Bug report logs - #985962
spamassassin: CVE-2020-1946: arbitrary code execution via malicious rule configuration files

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Noah Meyerhans <noahm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: spamassassin: arbitrary code execution via malicious rule configuration files

Date: Fri, 26 Mar 2021 15:03:55 -0700

Source: spamassassin
Version: 3.4.2-1+deb10u2
Severity: grave
Tags: security patch upstream
Justification: user security hole
X-Debbugs-Cc: Debian Security Team <team@security.debian.org>

CVE-2020-1946
Quoting from https://www.openwall.com/lists/oss-security/2021/03/24/3 :

    In Apache SpamAssassin before 3.4.5, malicious rule configuration
    (.cf) files can be configured to run system commands without any
    output or errors. With this, exploits can be injected in a number of
    scenarios.  In addition to upgrading to SA version 3.4.5, users
    should only use update channels or 3rd party .cf files from trusted
    places.

The fix was silently added to the 3.4 branch prior to 3.4.5~pre1 being
packaged for Debian, so it is already present in unstable and bullseye.

Buster remains exposed.

noah

Send a report that this bug log contains spam.