CVE-2020-1931 — Vulnetix

Try Vulnetix Request Demo

CVE-2020-1931 PUBLISHED

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.

EPSS 1.10% · 77.9th percentile

Risk Scores

EPSS Score

1.10%

77.9th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:18.04:LTS	spamassassin	3.4.2-0ubuntu0.18.04.2, 3.4.2-0ubuntu0.18.04.1, 3.4.1-8build1
Ubuntu:Pro:14.04:LTS	spamassassin	3.4.0-1ubuntu2, 3.4.0-1ubuntu2.1, 3.4.2-0ubuntu0.14.04.1
Ubuntu:16.04:LTS	spamassassin	3.4.2-0ubuntu0.16.04.2, 3.4.2-0ubuntu0.16.04.1, 3.4.1-3

Timeline

Jan 30, 2020 CVE Published
Apr 14, 2021 EPSS Score
Jun 22, 2021 EPSS Score
Oct 24, 2021 EPSS Score
Dec 25, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Apr 28, 2022 EPSS Score
Jun 29, 2022 EPSS Score
Aug 31, 2022 EPSS Score
Jan 2, 2023 EPSS Score

References

https://ubuntu.com/security/CVE-2020-1931 third-party-advisory
https://svn.apache.org/repos/asf/spamassassin/branches/3.4/build/announcements/3.4.4.txt third-party-advisory
https://www.openwall.com/lists/oss-security/2020/01/30/2 third-party-advisory
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7784 third-party-advisory
https://ubuntu.com/security/notices/USN-4265-1 vendor-advisory
https://ubuntu.com/security/notices/USN-4265-2 vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2020-1931 third-party-advisory

Open in Interactive Console →