Published: 30/01/2020 Updated: 07/11/2023

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.1 | Impact Score: 5.9 | Exploitability Score: 2.2

VMScore: 828

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

A command execution issue was found in Apache SpamAssassin before 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache spamassassin

Synopsis Moderate: spamassassin security update Type/Severity Security Advisory: Moderate Topic An update for spamassassin is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base ...

Debian Bug report logs - #950258 src:spamassassin: arbitrary code execution when processing rules files Package: src:spamassassin; Maintainer for src:spamassassin is Noah Meyerhans <noahm@debianorg>; Reported by: Noah Meyerhans <noahm@debianorg> Date: Thu, 30 Jan 2020 16:48:01 UTC Severity: grave Tags: security Fo ...

Several security issues were fixed in SpamAssassin ...

Two vulnerabilities were discovered in spamassassin, a Perl-based spam filter using text analysis Malicious rule or configuration files, possibly downloaded from an updates server, could execute arbitrary commands under multiple scenarios For the oldstable distribution (stretch), these problems have been fixed in version 342-1~deb9u3 For the s ...

oss-sec mailing list archives   By Date By Thread </form>    [CVE-2020-1931] Apache SpamAssassin Nefarious rule configuration (cf) files can be configured to run system commands with warn ...

CWE-78 https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7784 https://www.debian.org/security/2020/dsa-4615 https://seclists.org/bugtraq/2020/Feb/1 https://usn.ubuntu.com/4265-2/https://usn.ubuntu.com/4265-1/https://lists.debian.org/debian-lts-announce/2020/02/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00003.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B7SY2LUSH2X3IUXN4EQQ5A6QVUFYIV3D/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOVVKFP2G2AF5GHAB4WMHOEX76A3H6CE/https://access.redhat.com/errata/RHSA-2020:4625 https://nvd.nist.gov https://usn.ubuntu.com/4265-2/

CVE-2020-1931

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

References

Vulmon Search

About

Products

Connect