CVE-2020-1946

Related Vulnerabilities: CVE-2020-1946  

A flaw was found in spamassassin. Malicious rule configuration (.cf) files can be configured to run system commands without any output or errors allowing exploits to be injected in a number of scenarios. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Description

A flaw was found in spamassassin. Malicious rule configuration (.cf) files can be configured to run system commands without any output or errors allowing exploits to be injected in a number of scenarios. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Additional Information

  • Bugzilla 1943276: CVE-2020-1946 spamassassin: Malicious rule configuration files can be configured to run system commands
  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
  • FAQ: Frequently asked questions about CVE-2020-1946