8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.009 Low
EPSS
Percentile
82.1%
A command execution issue was found in Apache SpamAssassin prior to 3.4.3.
Carefully crafted nefarious Configuration (.cf) files can be configured to
run system commands similar to CVE-2018-11805. This issue is less stealthy
and attempts to exploit the issue will throw warnings. Thanks to Damian
Lukowski at credativ for reporting the issue ethically. With this bug
unpatched, exploits can be injected in a number of scenarios though doing
so remotely is difficult. In addition to upgrading to SA 3.4.4, we again
recommend that users should only use update channels or 3rd party .cf files
from trusted places.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 18.04 | noarch | spamassassin | < 3.4.2-0ubuntu0.18.04.3 | UNKNOWN |
ubuntu | 19.10 | noarch | spamassassin | < 3.4.2-1ubuntu0.19.10.2 | UNKNOWN |
ubuntu | 14.04 | noarch | spamassassin | < 3.4.2-0ubuntu0.14.04.1+esm2) Available with Ubuntu Pro or Ubuntu Pro (Infra-only | UNKNOWN |
ubuntu | 16.04 | noarch | spamassassin | < 3.4.2-0ubuntu0.16.04.3 | UNKNOWN |
bz.apache.org/SpamAssassin/show_bug.cgi?id=7784
launchpad.net/bugs/cve/CVE-2020-1931
nvd.nist.gov/vuln/detail/CVE-2020-1931
security-tracker.debian.org/tracker/CVE-2020-1931
svn.apache.org/repos/asf/spamassassin/branches/3.4/build/announcements/3.4.4.txt
ubuntu.com/security/notices/USN-4265-1
ubuntu.com/security/notices/USN-4265-2
www.cve.org/CVERecord?id=CVE-2020-1931
www.openwall.com/lists/oss-security/2020/01/30/2
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.009 Low
EPSS
Percentile
82.1%