High severity · published Jan 30, 2020
CVE-2020-1931
A command execution issue was found in Apache SpamAssassin prior to 3.4.3
8.1
CVSS
6.5%
EPSS
No
On KEV
Description
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.5% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Spamassassin · Apache
before 3.4.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-1931
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-1931
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00003.html
Permissions Required
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7784
lists.debian.org
https://lists.debian.org/debian-lts-announce/2020/02/msg00015.html
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B7SY2LUSH2X3IUXN4EQQ5A6QVUFYIV3D/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOVVKFP2G2AF5GHAB4WMHOEX76A3H6CE/
seclists.org
https://seclists.org/bugtraq/2020/Feb/1
More from Spamassassin
9.8
CVE-2020-1946
In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors
9.8
CVE-2018-11780
A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2
8.1
CVE-2020-1930
A command execution issue was found in Apache SpamAssassin prior to 3.4.3
7.8
CVE-2018-11781
Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax
7.8
CVE-2016-1238
(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6)…