In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade spamassassin | May 4, 2022 | Mar 25, 2021 |
| Alpine Linux | — | Upgrade spamassassin | Aug 22, 2024 | Mar 25, 2021 |
| Amazon Linux Ami 2 | — | Upgrade spamassassinUpgrade spamassassin-debuginfo | May 26, 2021 | Mar 25, 2021 |
| Centos_linux | — | Upgrade spamassassin-debugsourceUpgrade spamassassinUpgrade spamassassin-debuginfo | Nov 10, 2021 | Mar 25, 2021 |
| Debian | — | Upgrade spamassassin | Mar 29, 2021 | Mar 25, 2021 |
| Freebsd | — | Upgrade spamassassin | Mar 25, 2021 | Mar 24, 2021 |
| Gentoo Linux | — | Upgrade mail-filter/spamassassin. | May 28, 2021 | Mar 25, 2021 |
| Huawei Euleros 2_0_sp2 | — | Upgrade spamassassin | Sep 16, 2021 | Mar 25, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade spamassassin | Apr 30, 2021 | Mar 25, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade spamassassin | Jul 19, 2021 | Mar 25, 2021 |
| Oracle_linux | — | Upgrade spamassassin | Nov 17, 2021 | Mar 24, 2021 |
| Redhat_linux | — | No solution existsUpgrade spamassassinUpgrade spamassassin-debugsourceUpgrade spamassassin-debuginfo | Nov 10, 2021 | Mar 25, 2021 |
| Rocky_linux | — | Upgrade spamassassinUpgrade spamassassin-debugsourceUpgrade spamassassin-debuginfo | Mar 12, 2024 | Mar 25, 2021 |
| Suse | — | Upgrade spamassassinUpgrade perl-mail-spamassassin-plugin-ixhash2Upgrade perl-mail-spamassassin | Apr 13, 2021 | Mar 24, 2021 |
| Ubuntu | — | Upgrade spamassassin (Ubuntu Pro)Upgrade spamassassin | Apr 2, 2021 | Mar 24, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub