In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from trusted places.
CVSS Details
- CVSS 3.1 Base Score: 6.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-spamassassin | May 4, 2022 | Dec 12, 2019 | |
| Alpine Linux | alpine-linux-upgrade-spamassassin | Jan 3, 2020 | Dec 12, 2019 | |
| Amazon_linux | — | amazon-linux-upgrade-spamassassin | Feb 8, 2020 | Dec 12, 2019 |
| Centos_linux | — | centos-upgrade-spamassassincentos-upgrade-spamassassin-debuginfocentos-upgrade-spamassassin-debugsource | Nov 5, 2020 | Dec 12, 2019 |
| Debian | debian-upgrade-spamassassin | Dec 16, 2019 | Dec 12, 2019 | |
| Freebsd | freebsd-upgrade-package-spamassassin | Dec 14, 2019 | Dec 13, 2019 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-spamassassin | Sep 16, 2021 | Dec 12, 2019 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-spamassassin | Apr 30, 2021 | Dec 12, 2019 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-spamassassin | Mar 24, 2021 | Dec 12, 2019 | |
| Oracle_linux | — | oracle-linux-upgrade-spamassassin | Nov 12, 2020 | Dec 12, 2019 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-spamassassinredhat-upgrade-spamassassin-debuginforedhat-upgrade-spamassassin-debugsource | Nov 5, 2020 | Dec 12, 2019 | |
| Suse | — | suse-upgrade-perl-mail-spamassassinsuse-upgrade-perl-mail-spamassassin-plugin-ixhash2suse-upgrade-spamassassin | Mar 31, 2020 | Dec 12, 2019 |
| Ubuntu | ubuntu-pro-upgrade-spamassassinubuntu-upgrade-spamassassin | Jan 14, 2020 | Dec 12, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub