Not rated
CVE-2018-11805 In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or…
Description
In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from trusted places.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache SpamAssassin | Versions not published |
References
- [spamassassin-users] 20191212 [SECURITY] Apache SpamAssassin v3.4.3 released with fix for CVE-2018-11805 lists.apache.org
- [spamassassin-dev] 20191212 [SECURITY] Apache SpamAssassin v3.4.3 released with fix for CVE-2018-11805 lists.apache.org
- [spamassassin-announce] 20191212 [SECURITY] Apache SpamAssassin v3.4.3 released with fix for CVE-2018-11805 lists.apache.org
- [oss-security] 20191212 Apache SpamAssassin v3.4.3 released with fix for CVE-2018-11805 www.openwall.com
- [announce] 20191212 [SECURITY] Apache SpamAssassin v3.4.3 released with fix for CVE-2018-11805 lists.apache.org
- seclists.org seclists.org
- svn.apache.org svn.apache.org
- bz.apache.org bz.apache.org
- DSA-4584 www.debian.org
- 20191216 [SECURITY] [DSA 4584-1] spamassassin security update seclists.org
- [debian-lts-announce] 20191216 [SECURITY] [DLA 2037-1] spamassassin security update lists.debian.org
- [spamassassin-users] 20191218 CVE-2018-11805 fix and sa-exim lists.apache.org
- [spamassassin-users] 20191218 Re: CVE-2018-11805 fix and sa-exim lists.apache.org
- [spamassassin-users] 20191219 Re: CVE-2018-11805 fix and sa-exim lists.apache.org
- USN-4237-1 usn.ubuntu.com
- USN-4237-2 usn.ubuntu.com
- [spamassassin-dev] 20200130 [CVE-2020-1931] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands with warnings. lists.apache.org
- [spamassassin-announce] 20200130 [CVE-2020-1931] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands with warnings. lists.apache.org
- [spamassassin-users] 20200130 [CVE-2020-1931] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands with warnings. lists.apache.org
- [spamassassin-users] 20200130 [CVE-2020-1930] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands lists.apache.org
- [spamassassin-announce] 20200130 [CVE-2020-1930] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands lists.apache.org
- [announce] 20200130 [CVE-2020-1931] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands with warnings. lists.apache.org
- [spamassassin-dev] 20200130 [CVE-2020-1930] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands lists.apache.org
- [oss-security] 20200130 [CVE-2020-1930] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands www.openwall.com
- [oss-security] 20200130 [CVE-2020-1931] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands with warnings. www.openwall.com
- [spamassassin-users] 20200130 Re: ANNOUNCE: Apache SpamAssassin 3.4.4 available lists.apache.org
- [announce] 20200130 [CVE-2020-1930] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands lists.apache.org
- [spamassassin-users] 20200131 Re: ANNOUNCE: Apache SpamAssassin 3.4.4 available lists.apache.org
- openSUSE-SU-2020:0446 lists.opensuse.org
Timeline
- Published
- Last modified