798 matches found
Apache SpamAssassin Injection Vulnerability
Apache SpamAssassin is an open source spam filter from the Apache USA Foundation. The product provides system administrators with a filter and support for categorizing email to block spam. An injection vulnerability exists in Apache SpamAssassin versions prior to 3.4.5 that allows configuration o...
Debian DSA-4879-1 : spamassassin - security update
Damian Lukowski discovered a flaw in spamassassin, a Perl-based spam filter using text analysis. Malicious rule configuration files, possibly downloaded from an updates server, could execute arbitrary commands under multiple scenarios. C Tenable Network Security, Inc. The descriptive text and...
Debian: Security Advisory (DSA-4879-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Security fix for the ALT Linux 9 package spamassassin version 3.4.5-alt1
3.4.5-alt1 built March 29, 2021 Sergey Y. Afonin in task 268491 --- March 25, 2021 Konstantin Lepikhov - 3.4.5 fixes: CVE-2020-1946 - remove dkim patch fixed by upstream...
Command Injection
Apache SpamAssassin is vulnerable to command injection. malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios...
[SECURITY] [DSA 4879-1] spamassassin security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4879-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 27, 2021 https://www.debian.org/security/faq -...
[SECURITY] [DSA 4879-1] spamassassin security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4879-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 27, 2021 https://www.debian.org/security/faq -...
DSA-4879-1 spamassassin - security update
Bulletin has no description...
FreeBSD : spamassassin -- Malicious rule configuration (.cf) files can be configured to run system commands (ec04f3d0-8cd9-11eb-bb9f-206a8a720317)
The Apache SpamAssassin project reports : Apache SpamAssassin 3.4.5 was recently released 1, and fixes an issue of security note where malicious rule configuration .cf files can be configured to run system commands. In Apache SpamAssassin before 3.4.5, exploits can be injected in a number of...
CVE-2020-1946
A flaw was found in spamassassin. Malicious rule configuration .cf files can be configured to run system commands without any output or errors allowing exploits to be injected in a number of scenarios. The highest threat from this vulnerability is to data confidentiality and integrity as well as...
CVE-2020-1946
In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3...
DEBIAN-CVE-2020-1946
In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3...
CVE-2020-1946
In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3...
ALPINE-CVE-2020-1946
In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3...
Design/Logic Flaw
In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3...
CVE-2020-1946
CVE-2020-1946 affects Apache SpamAssassin prior to 3.4.5. Malicious rule configuration files (.cf) can be crafted to execute system commands without output or errors, enabling command execution in multiple scenarios. Root cause: untrusted .cf content can trigger privileged actions. Impact: potent...
CVE-2020-1946 Apache SpamAssassin has an OS Command Injection vulnerability
In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3...
CVE-2020-1946
In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3...
Apache SpamAssassin 操作系统命令注入漏洞
Apache SpamAssassin is an open source spam filter from the Apache USA Foundation. The product provides system administrators with a filter and support for categorizing email to block spam. An injection vulnerability exists in Apache SpamAssassin versions prior to 3.4.5 that allows configuration o...
spamassassin -- Malicious rule configuration (.cf) files can be configured to run system commands
The Apache SpamAssassin project reports: Apache SpamAssassin 3.4.5 was recently released 1, and fixes an issue of security note where malicious rule configuration .cf files can be configured to run system commands. In Apache SpamAssassin before 3.4.5, exploits can be injected in a number of...