Login Request a demo
Critical severity · published Mar 25, 2021
CVE-2020-1946
In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors
9.8
CVSS
6.1%
EPSS
No
On KEV
Description
In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.1% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
9.0; 10.0 · source: NVD
FE
Fedora · Fedoraproject
32; 33; 34 · source: NVD
SP
Spamassassin · Apache
before 3.4.5 · source: NVD
Affected product
SP
Spamassassin
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-1946
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-1946
Mailing List
https://lists.debian.org/debian-lts-announce/2021/04/msg00000.html
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7V2SBVTKVLFFT36ECJQ7TQ7KAQCQZDRZ/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JFBFRIG5TX23NF4ND6OAKKY7I6TLRCCP/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKAXYBKBMQOLIW6UKASJCAZRBOIYS4RL/
Mailing List
https://s.apache.org/3r1wh
Third Party Advisory
https://security.gentoo.org/glsa/202105-26
More from Spamassassin
9.8
CVE-2018-11780
A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2
8.1
CVE-2020-1931
A command execution issue was found in Apache SpamAssassin prior to 3.4.3
8.1
CVE-2020-1930
A command execution issue was found in Apache SpamAssassin prior to 3.4.3
7.8
CVE-2018-11781
Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax
7.8
CVE-2016-1238
(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6)…