CVE-2020-1946
moderate-risk
Published 2021-03-25
In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places.
Do I need to act?
~
1.5% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10
Critical
NETWORK
/ LOW complexity
Affected Products (6)
Affected Vendors
References (14)
Mailing List
https://s.apache.org/3r1wh
Third Party Advisory
https://security.gentoo.org/glsa/202105-26
Third Party Advisory
https://www.debian.org/security/2021/dsa-4879
Mailing List
https://s.apache.org/3r1wh
Third Party Advisory
https://security.gentoo.org/glsa/202105-26
Third Party Advisory
https://www.debian.org/security/2021/dsa-4879
49
/ 100
moderate-risk
Severity
32/34 · Critical
Exploitability
4/34 · Minimal
Exposure
13/34 · Low