[SECURITY] [DLA 2107-1] spamassassin security update

2020-02-1812:54:51

lists.debian.org

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.009

Percentile

82.4%

JSON

Package : spamassassin
Version : 3.4.2-0+deb8u3
CVE ID : CVE-2020-1930 CVE-2020-1931
Debian Bug : 950258

Two vulnerabilities were discovered in spamassassin, a Perl-based spam
filter using text analysis. Malicious rule or configuration files,
possibly downloaded from an updates server, could execute arbitrary
commands under multiple scenarios.

For Debian 8 "Jessie", these problems have been fixed in version
3.4.2-0+deb8u3.

We recommend that you upgrade your spamassassin packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10i386spamc< 3.4.2-1+deb10u2spamc_3.4.2-1+deb10u2_i386.deb
Debian10mipsspamc-dbgsym< 3.4.2-1+deb10u2spamc-dbgsym_3.4.2-1+deb10u2_mips.deb
Debian8amd64spamc< 3.4.2-0+deb8u3spamc_3.4.2-0+deb8u3_amd64.deb
Debian10mips64elspamc< 3.4.2-1+deb10u2spamc_3.4.2-1+deb10u2_mips64el.deb
Debian10allsa-compile< 3.4.2-1+deb10u2sa-compile_3.4.2-1+deb10u2_all.deb
Debian9mipsspamc-dbgsym< 3.4.2-1~deb9u3spamc-dbgsym_3.4.2-1~deb9u3_mips.deb
Debian9mipselspamc< 3.4.2-1~deb9u3spamc_3.4.2-1~deb9u3_mipsel.deb
Debian9i386spamc-dbgsym< 3.4.2-1~deb9u3spamc-dbgsym_3.4.2-1~deb9u3_i386.deb
Debian10s390xspamc-dbgsym< 3.4.2-1+deb10u2spamc-dbgsym_3.4.2-1+deb10u2_s390x.deb
Debian10armelspamc-dbgsym< 3.4.2-1+deb10u2spamc-dbgsym_3.4.2-1+deb10u2_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	i386	spamc	< 3.4.2-1+deb10u2	spamc_3.4.2-1+deb10u2_i386.deb
Debian	10	mips	spamc-dbgsym	< 3.4.2-1+deb10u2	spamc-dbgsym_3.4.2-1+deb10u2_mips.deb
Debian	8	amd64	spamc	< 3.4.2-0+deb8u3	spamc_3.4.2-0+deb8u3_amd64.deb
Debian	10	mips64el	spamc	< 3.4.2-1+deb10u2	spamc_3.4.2-1+deb10u2_mips64el.deb
Debian	10	all	sa-compile	< 3.4.2-1+deb10u2	sa-compile_3.4.2-1+deb10u2_all.deb
Debian	9	mips	spamc-dbgsym	< 3.4.2-1~deb9u3	spamc-dbgsym_3.4.2-1~deb9u3_mips.deb
Debian	9	mipsel	spamc	< 3.4.2-1~deb9u3	spamc_3.4.2-1~deb9u3_mipsel.deb
Debian	9	i386	spamc-dbgsym	< 3.4.2-1~deb9u3	spamc-dbgsym_3.4.2-1~deb9u3_i386.deb
Debian	10	s390x	spamc-dbgsym	< 3.4.2-1+deb10u2	spamc-dbgsym_3.4.2-1+deb10u2_s390x.deb
Debian	10	armel	spamc-dbgsym	< 3.4.2-1+deb10u2	spamc-dbgsym_3.4.2-1+deb10u2_armel.deb