CVE-2020-1946 Apache SpamAssassin has an OS Command Injection vulnerability
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2020-1946?
CVE-2020-1946 is a critical vulnerability in Debian Debian Linux, published on 25 Mar 2021.
Official description
In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places.
Weakness: CWE-78
Which versions are affected by CVE-2020-1946?
It affects 3 products.
Linux distribution packages (5)
spamassassin AlmaLinux:8 | All versions | 3.4.4-4.el8 |
spamassassin Red Hat:enterprise_linux:8::appstream | All versions | 0:3.4.4-4.el8 |
spamassassin-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.4.4-4.el8 |
spamassassin-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:3.4.4-4.el8 |
spamassassin Rocky Linux:8 | All versions | 0:3.4.4-4.el8 |
Products include Apache Spamassassin, Debian Debian Linux, Fedoraproject Fedora.
How do I fix CVE-2020-1946?
Upgrade to a fixed version.
Is CVE-2020-1946 being exploited?
There is no known exploitation of CVE-2020-1946 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
- CVE-2018-11780 Code injection in Apache SpamAssassin
- CVE-2020-1930 Command injection in Apache SpamAssassin
- CVE-2020-1931 Command injection in Apache SpamAssassin
- CVE-2018-11781 Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.
- CVE-2016-1238 Privilege escalation in n/a
Sources
Also known as ALPINE-CVE-2020-1946, ALSA-2021:4315, DEBIAN-CVE-2020-1946, DLA-2615-1, DSA-4879-1, GHSA-qmmx-pr2m-q429 and 6 more.