The vulnerability of spam filtering systems using Perl-based text analysis tools like SpamAssassin arises from the failure to address the special elements used in operating system commands. This allows attackers to access confidential data, compromise its integrity, and cause service interruptions.

🗓️ 07 May 2020 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Vulnerability in spam filters using Perl based analysis due to misconfigured commands, enabling data access, integrity compromise, and service disruption.

Reporter	Title	Published	Views	Family All 82
Tenable Nessus	Alibaba Cloud Linux 3 : 0040: spamassassin (ALINUX3-SA-2022:0040)	14 May 202500:00	–	nessus
Tenable Nessus	CentOS 8 : spamassassin (CESA-2020:4625)	1 Feb 202100:00	–	nessus
Tenable Nessus	Debian DLA-2107-1 : spamassassin security update	19 Feb 202000:00	–	nessus
Tenable Nessus	Debian DSA-4615-1 : spamassassin - security update	3 Feb 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP5 : spamassassin (EulerOS-SA-2020-2272)	30 Oct 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP3 : spamassassin (EulerOS-SA-2021-1120)	20 Jan 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP2 : spamassassin (EulerOS-SA-2021-1360)	22 Feb 202100:00	–	nessus
Tenable Nessus	Fedora 31 : spamassassin (2020-24dac7d890)	12 Feb 202000:00	–	nessus
Tenable Nessus	Fedora 30 : spamassassin (2020-bd20036cdc)	12 Feb 202000:00	–	nessus
Tenable Nessus	FreeBSD : spamassassin -- Nefarious rule configuration files can run system commands (c86bfee3-4441-11ea-8be3-54e1ad3d6335)	3 Feb 202000:00	–	nessus

Vulners

Node

apache spamassassinRange<3.4.3

red_hat red_hat_enterprise_linuxMatch7

red_hat red_hat_enterprise_linuxMatch8

novell opensuse_leapMatch15.1

fedora fedoraMatch30

fedora fedoraMatch31

canonical ubuntuMatch19.10

Source	Link
lists	www.lists.opensuse.org/opensuse-security-announce/2020-04/msg00003.html
access	www.access.redhat.com/security/cve/CVE-2020-1931
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/B7SY2LUSH2X3IUXN4EQQ5A6QVUFYIV3D/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/VOVVKFP2G2AF5GHAB4WMHOEX76A3H6CE/
usn	www.usn.ubuntu.com/4265-1/
usn	www.usn.ubuntu.com/4265-2/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-1931
security-tracker	www.security-tracker.debian.org/tracker/CVE-2020-1931
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.5/
altsp	www.altsp.su/obnovleniya-bezopasnosti/

16 Sep 2024 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 27.6

CVSS 38.1

EPSS0.06464