vulnerability
FreeBSD: VID-EC04F3D0-8CD9-11EB-BB9F-206A8A720317 (CVE-2020-1946): spamassassin -- Malicious rule configuration (.cf) files can be configured to run system commands
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 10 | (AV:N/AC:L/Au:N/C:C/I:C/A:C) | Mar 24, 2021 | Mar 25, 2021 | Jun 3, 2021 |
Description
Details for this vulnerability have not been published by NIST at this point. Descriptions from software vendor advisories for this issue are provided below.
From VID-EC04F3D0-8CD9-11EB-BB9F-206A8A720317:
The Apache SpamAssassin project reports:
Apache SpamAssassin 3.4.5 was recently released [1], and fixes
an issue of security note where malicious rule configuration (.cf)
files can be configured to run system commands.
In Apache SpamAssassin before 3.4.5, exploits can be injected in
a number of scenarios. In addition to upgrading to SA 3.4.5,
users should only use update channels or 3rd party .cf files from
trusted places.
Solution
References
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.