CVE-2020-1931
published 2020-01-30CVE-2020-1931: A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run…
PriorityP353high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
6.46%
93.0th percentile
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | spamassassin | < 3.4.3 | 3.4.3 |
| apache | spamassassin | >= 0 < 3.4.4~rc1-1 | 3.4.4~rc1-1 |
| apache | spamassassin | >= 0 < 3.4.4~rc1-1 | 3.4.4~rc1-1 |
| apache | spamassassin | >= 0 < 3.4.4~rc1-1 | 3.4.4~rc1-1 |
| apache | spamassassin | >= 0 < 3.4.4~rc1-1 | 3.4.4~rc1-1 |
| debian | spamassassin | < spamassassin 3.4.4~rc1-1 (bookworm) | spamassassin 3.4.4~rc1-1 (bookworm) |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
osv6.7MEDIUM
vendor_debian6.7MEDIUM
vendor_redhat6.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
SpamAssassin vulnerabilities
vendor_ubuntu·2020-02-04
CVE-2020-1930 SpamAssassin vulnerabilities
Title: SpamAssassin vulnerabilities
Summary: Several security issues were fixed in SpamAssassin.
USN-4265-1 fixed several vulnerabilities in SpamAssassin. This update provides
the corresponding update for Ubuntu 12.04 ESM and 14.04 ESM.
Original advisory details:
It was discovered that SpamAssassin incorrectly handled certain CF files.
If a user or automated system were tricked into using a specially-crafted
CF file, a remote attacker could possibly run arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
SpamAssassin vulnerabilities
vendor_ubuntu·2020-02-04
CVE-2020-1930 SpamAssassin vulnerabilities
Title: SpamAssassin vulnerabilities
Summary: Several security issues were fixed in SpamAssassin.
It was discovered that SpamAssassin incorrectly handled certain CF files.
If a user or automated system were tricked into using a specially-crafted
CF file, a remote attacker could possibly run arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
spamassassin: command injection via crafted configuration file
vendor_redhat·2020-01-29·CVSS 6.7
CVE-2020-1931 [MEDIUM] CWE-78 spamassassin: command injection via crafted configuration file
spamassassin: command injection via crafted configuration file
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.
Statement: The attack is triggered by malicious specially crafted .cf files which are basically configuration files for spam
Debian
CVE-2020-1931: spamassassin - A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Caref...
vendor_debian·2020·CVSS 6.7
CVE-2020-1931 [MEDIUM] CVE-2020-1931: spamassassin - A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Caref...
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.
Scope: local
bookworm: resolved (fixed in 3.4.4~rc1-1)
bullseye: resolved (fixed in 3.4.4~rc1-1)
forky: resolved (fixed in 3.4.4~rc1-1)
sid: resolved (fixed in 3.4.4~rc1-1)
trixie: resolved
GHSA
GHSA-p22p-qh9c-7725: A command execution issue was found in Apache SpamAssassin prior to 3
ghsa_unreviewed·2022-05-24·CVSS 6.7
CVE-2020-1931 [MEDIUM] GHSA-p22p-qh9c-7725: A command execution issue was found in Apache SpamAssassin prior to 3
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.
OSV
CVE-2020-1931: A command execution issue was found in Apache SpamAssassin prior to 3
osv·2020-01-30·CVSS 6.7
CVE-2020-1931 [MEDIUM] CVE-2020-1931: A command execution issue was found in Apache SpamAssassin prior to 3
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00003.htmlhttps://bz.apache.org/SpamAssassin/show_bug.cgi?id=7784https://lists.debian.org/debian-lts-announce/2020/02/msg00015.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B7SY2LUSH2X3IUXN4EQQ5A6QVUFYIV3D/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOVVKFP2G2AF5GHAB4WMHOEX76A3H6CE/https://seclists.org/bugtraq/2020/Feb/1https://usn.ubuntu.com/4265-1/https://usn.ubuntu.com/4265-2/https://www.debian.org/security/2020/dsa-4615http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00003.htmlhttps://bz.apache.org/SpamAssassin/show_bug.cgi?id=7784https://lists.debian.org/debian-lts-announce/2020/02/msg00015.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B7SY2LUSH2X3IUXN4EQQ5A6QVUFYIV3D/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOVVKFP2G2AF5GHAB4WMHOEX76A3H6CE/https://seclists.org/bugtraq/2020/Feb/1https://usn.ubuntu.com/4265-1/https://usn.ubuntu.com/4265-2/https://www.debian.org/security/2020/dsa-4615
2020-01-30
Published