CVE-2020-1930
published 2020-01-30CVE-2020-1930: A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run…
PriorityP352high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
7.05%
93.5th percentile
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. With this bug unpatched, exploits can be injected in a number of scenarios including the same privileges as spamd is run which may be elevated though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places. If you cannot upgrade, do not use 3rd party rulesets, do not use sa-compile and do not run spamd as an account with elevated privileges.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | spamassassin | < 3.4.3 | 3.4.3 |
| apache | spamassassin | >= 0 < 3.4.4~rc1-1 | 3.4.4~rc1-1 |
| apache | spamassassin | >= 0 < 3.4.4~rc1-1 | 3.4.4~rc1-1 |
| apache | spamassassin | >= 0 < 3.4.4~rc1-1 | 3.4.4~rc1-1 |
| apache | spamassassin | >= 0 < 3.4.4~rc1-1 | 3.4.4~rc1-1 |
| debian | spamassassin | < spamassassin 3.4.4~rc1-1 (bookworm) | spamassassin 3.4.4~rc1-1 (bookworm) |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
osv6.7MEDIUM
vendor_debian6.7MEDIUM
vendor_redhat6.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
SpamAssassin vulnerabilities
vendor_ubuntu·2020-02-04
CVE-2020-1930 SpamAssassin vulnerabilities
Title: SpamAssassin vulnerabilities
Summary: Several security issues were fixed in SpamAssassin.
USN-4265-1 fixed several vulnerabilities in SpamAssassin. This update provides
the corresponding update for Ubuntu 12.04 ESM and 14.04 ESM.
Original advisory details:
It was discovered that SpamAssassin incorrectly handled certain CF files.
If a user or automated system were tricked into using a specially-crafted
CF file, a remote attacker could possibly run arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
SpamAssassin vulnerabilities
vendor_ubuntu·2020-02-04
CVE-2020-1930 SpamAssassin vulnerabilities
Title: SpamAssassin vulnerabilities
Summary: Several security issues were fixed in SpamAssassin.
It was discovered that SpamAssassin incorrectly handled certain CF files.
If a user or automated system were tricked into using a specially-crafted
CF file, a remote attacker could possibly run arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
spamassassin: command injection via crafted configuration file
vendor_redhat·2020-01-30·CVSS 6.7
CVE-2020-1930 [MEDIUM] CWE-78 spamassassin: command injection via crafted configuration file
spamassassin: command injection via crafted configuration file
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. With this bug unpatched, exploits can be injected in a number of scenarios including the same privileges as spamd is run which may be elevated though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places. If you cannot upgrade, do not use 3rd party rulesets, do not use sa-compile and do not run spamd as an account with elevated privileges.
Statement: The attack is triggered by malicious specially crafted .cf
Debian
CVE-2020-1930: spamassassin - A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Caref...
vendor_debian·2020·CVSS 6.7
CVE-2020-1930 [MEDIUM] CVE-2020-1930: spamassassin - A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Caref...
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. With this bug unpatched, exploits can be injected in a number of scenarios including the same privileges as spamd is run which may be elevated though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places. If you cannot upgrade, do not use 3rd party rulesets, do not use sa-compile and do not run spamd as an account with elevated privileges.
Scope: local
bookworm: resolved (fixed in 3.4.4~rc1-1)
bullseye: resolved (fixed in 3.4.4~rc1-1)
forky: resolved (fixed in 3.4.4~rc1-1)
GHSA
GHSA-pxq8-92ff-q845: A command execution issue was found in Apache SpamAssassin prior to 3
ghsa_unreviewed·2022-05-24·CVSS 6.7
CVE-2020-1930 [MEDIUM] GHSA-pxq8-92ff-q845: A command execution issue was found in Apache SpamAssassin prior to 3
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. With this bug unpatched, exploits can be injected in a number of scenarios including the same privileges as spamd is run which may be elevated though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places. If you cannot upgrade, do not use 3rd party rulesets, do not use sa-compile and do not run spamd as an account with elevated privileges.
OSV
CVE-2020-1930: A command execution issue was found in Apache SpamAssassin prior to 3
osv·2020-01-30·CVSS 6.7
CVE-2020-1930 [MEDIUM] CVE-2020-1930: A command execution issue was found in Apache SpamAssassin prior to 3
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. With this bug unpatched, exploits can be injected in a number of scenarios including the same privileges as spamd is run which may be elevated though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places. If you cannot upgrade, do not use 3rd party rulesets, do not use sa-compile and do not run spamd as an account with elevated privileges.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00003.htmlhttps://bz.apache.org/SpamAssassin/show_bug.cgi?id=7648https://lists.apache.org/thread.html/r6729f3d3be754a06c39bb4f11c925a3631e8ea2b4c865546d755cb0a%40%3Cannounce.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2020/02/msg00015.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B7SY2LUSH2X3IUXN4EQQ5A6QVUFYIV3D/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOVVKFP2G2AF5GHAB4WMHOEX76A3H6CE/https://seclists.org/bugtraq/2020/Feb/1https://usn.ubuntu.com/4265-1/https://usn.ubuntu.com/4265-2/https://www.debian.org/security/2020/dsa-4615http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00003.htmlhttps://bz.apache.org/SpamAssassin/show_bug.cgi?id=7648https://lists.apache.org/thread.html/r6729f3d3be754a06c39bb4f11c925a3631e8ea2b4c865546d755cb0a%40%3Cannounce.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2020/02/msg00015.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B7SY2LUSH2X3IUXN4EQQ5A6QVUFYIV3D/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOVVKFP2G2AF5GHAB4WMHOEX76A3H6CE/https://seclists.org/bugtraq/2020/Feb/1https://usn.ubuntu.com/4265-1/https://usn.ubuntu.com/4265-2/https://www.debian.org/security/2020/dsa-4615
2020-01-30
Published