PT-2020-2097 · Apache+5 · Apache Spamassassin+5
Kevin A. Mcgrail
·
Published
2020-01-03
·
Updated
2024-06-15
·
CVE-2020-1930
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Apache SpamAssassin versions prior to 3.4.3
Description
The issue is related to a command execution problem in the spam filter, potentially allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. This can occur due to malicious rule configuration files that could be downloaded from an update server. The exploitation may involve running system commands with elevated privileges, although remote exploitation is considered difficult. It is recommended to only use trusted update channels and third-party configuration files to minimize the risk.
Recommendations
For versions prior to 3.4.3, upgrade to Apache SpamAssassin 3.4.4 to resolve the issue.
As a temporary workaround, consider not using third-party rulesets and avoid running spamd with elevated privileges until the issue is resolved.
Additionally, refrain from using sa-compile until a patch is applied.
Fix
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Apache Spamassassin
Centos
Red Hat
Suse
Ubuntu