CVE-2018-11805 In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors.

What is CVE-2018-11805?

CVE-2018-11805 is a medium-severity vulnerability in Debian Debian Linux, published on 12 Dec 2019.

Official description

In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from trusted places.

Weakness: CWE-78

Which versions are affected by CVE-2018-11805?

It affects 2 products.

Products include Apache Spamassassin, Debian Debian Linux.

How do I fix CVE-2018-11805?

Upgrade to a fixed version.

Is CVE-2018-11805 being exploited?

There is no known exploitation of CVE-2018-11805 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2020-1946 Apache SpamAssassin has an OS Command Injection vulnerability Critical 9.8
• CVE-2018-11780 Code injection in Apache SpamAssassin Critical 9.8
• CVE-2020-1930 Command injection in Apache SpamAssassin High 8.1
• CVE-2020-1931 Command injection in Apache SpamAssassin High 8.1
• CVE-2018-11781 Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax. High 7.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2018-11805, CLSA-2026-1777548876, CLSA-2026-1777548877, DEBIAN-CVE-2018-11805, GHSA-639c-xqgw-3jh5, UBUNTU-CVE-2018-11805.