PT-2019-16009 · Exim+1 · Sa-Exim+1

Henrik Krohns · Published 2019-12-22 · Updated 2022-12-14 · CVE-2019-19920

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions sa-exim version 4.2.1

Description The issue allows attackers to execute arbitrary code if they can write a .cf file or a rule. This occurs because Greylisting.pm relies on eval rather than direct parsing and/or use of the taint feature.

Recommendations For sa-exim version 4.2.1, consider disabling the use of eval in Greylisting.pm or restrict access to writing .cf files and rules until a patch is available.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-19920

DLA-2062-1

USN-4520-1

Affected Products

Ubuntu

Sa-Exim

References · 15

• https://osv.dev/vulnerability/DEBIAN-CVE-2019-19920 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19920 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19920 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-19920 · Security Note
• https://osv.dev/vulnerability/DLA-2062-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19920 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-19920 · Vendor Advisory
• https://bugs.debian.org/946829#24 · Patch
• https://usn.ubuntu.com/4520-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4520-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19920 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4520-1 · Vendor Advisory
• https://marc.info/?l=spamassassin-users&m=157668305026635&w=2 · Note
• https://lists.debian.org/debian-lts-announce/2020/01/msg00006.html · Note
• https://marc.info/?l=spamassassin-users&m=157668107325768&w=2 · Note