Log in Start free

Vulnerability · Published Mar 25, 2021 · Assigned by apache

CVE-2020-1946Apache SpamAssassin has an OS Command Injection vulnerability

Critical 9.8

In plain English

A critical-severity OS command injection in Apache SpamAssassin from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.1% (higher than 93% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)6.1%top 6.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8spamassassin3.4.4-4.el8ALSA-2021:4315
Alpine:v3.20spamassassin3.4.5-r0ALPINE-CVE-2020-1946
Alpine:v3.21spamassassin3.4.5-r0ALPINE-CVE-2020-1946
Alpine:v3.22spamassassin3.4.5-r0ALPINE-CVE-2020-1946
Alpine:v3.23spamassassin3.4.5-r0ALPINE-CVE-2020-1946
Alpine:v3.24spamassassin3.4.5-r0ALPINE-CVE-2020-1946
Debian:12spamassassin3.4.5~pre1-1DEBIAN-CVE-2020-1946
Debian:13spamassassin3.4.5~pre1-1DEBIAN-CVE-2020-1946
Debian:14spamassassin3.4.5~pre1-1DEBIAN-CVE-2020-1946
Rocky Linux:8spamassassin0:3.4.4-4.el8RLSA-2021:4315

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache SpamAssassin Apache SpamAssassin – before 3.4.5

Weakness: CWE-78

References