OS Command Injection in SpamAssassin - CVE-2020-1930

Vulnerability identifier: #VU24819

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-1930

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to insufficient sanitization of nefarious rule configuration (.cf) files. A remote attacker can supply a specially crafted .cf file and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

SpamAssassin
spamassassin (Alpine package)
spamassassin (Debian package)
spamassassin (Red Hat package)
spamassassin
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Opensuse
Fedora

Install updates from vendor's website.

SpamAssassin - update to 3.4.3
spamassassin (Alpine package) - update to 3.4.4-r0
spamassassin (Debian package) - addressed in versions 3.4.2-1+deb10u2, 3.4.2-1~deb9u3
spamassassin (Red Hat package) - update to 3.4.2-10.el8
spamassassin - addressed in versions 3.4.4-1.fc30, 3.4.4-1.fc31

• https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7648
• https://lists.apache.org/thread.html/r6729f3d3be754a06c39bb4f11c925a3631e8ea2b4c865546d755cb0a@%3Cannounce.apache.org%3E
• https://www.debian.org/security/2020/dsa-4615

• Multiple vulnerabilities in Apache SpamAssassin
• Debian update for spamassassin
• OpenSUSE Linux update for spamassassin
• OS Command Injection in spamassassin (Alpine package)
• Red Hat Enterprise Linux 8 update for spamassassin
• Fedora 31 update for spamassassin
• Fedora 30 update for spamassassin