Apache Spamassassin vulnerabilities

2 known vulnerabilities affecting apache/apache_spamassassin.

Total CVEs

2

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

HIGH1MEDIUM1

Vulnerabilities

Page 1 of 1

CVE-2019-12420HIGHCVSS 7.5vApache SpamAssassin prior to 3.4.32019-12-12

CVE-2019-12420 [HIGH] CWE-400 CVE-2019-12420: In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. U In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly.

CVE-2018-11805MEDIUMCVSS 6.7vApache SpamAssassin prior to 3.4.32019-12-12

CVE-2018-11805 [MEDIUM] CVE-2018-11805: In Apache SpamAssassin before 3 In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from trusted places.