In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from trusted places.
CVSS Details
- CVSS 3.1 Base Score: 6.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade spamassassin | May 4, 2022 | Dec 12, 2019 |
| Alpine Linux | — | Upgrade spamassassin | Jan 3, 2020 | Dec 12, 2019 |
| Amazon_linux | — | Upgrade spamassassin | Feb 8, 2020 | Dec 12, 2019 |
| Centos_linux | — | Upgrade spamassassinUpgrade spamassassin-debugsourceUpgrade spamassassin-debuginfo | Nov 5, 2020 | Dec 12, 2019 |
| Debian | — | Upgrade spamassassin | Dec 16, 2019 | Dec 12, 2019 |
| Freebsd | — | Upgrade spamassassin | Dec 14, 2019 | Dec 13, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade spamassassin | Sep 16, 2021 | Dec 12, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade spamassassin | Apr 30, 2021 | Dec 12, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade spamassassin | Mar 24, 2021 | Dec 12, 2019 |
| Oracle_linux | — | Upgrade spamassassin | Nov 12, 2020 | Dec 12, 2019 |
| Redhat_linux | — | Upgrade spamassassin-debuginfoUpgrade spamassassin-debugsourceNo solution existsUpgrade spamassassin | Nov 5, 2020 | Dec 12, 2019 |
| Suse | — | Upgrade perl-mail-spamassassinUpgrade perl-mail-spamassassin-plugin-ixhash2Upgrade spamassassin | Mar 31, 2020 | Dec 12, 2019 |
| Ubuntu | — | Upgrade spamassassinUpgrade spamassassin (Ubuntu Pro) | Jan 14, 2020 | Dec 12, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub