CVE-2020-1931

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.

CVSS v3.0 8.1 HIGH
CVSS v2.0 9.3 HIGH

8.1^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7784	Permissions Required
https://www.debian.org/security/2020/dsa-4615
https://seclists.org/bugtraq/2020/Feb/1
https://usn.ubuntu.com/4265-2/
https://usn.ubuntu.com/4265-1/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOVVKFP2G2AF5GHAB4WMHOEX76A3H6CE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B7SY2LUSH2X3IUXN4EQQ5A6QVUFYIV3D/
https://lists.debian.org/debian-lts-announce/2020/02/msg00015.html
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00003.html

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:spamassassin:*:*:*:*:*:*:*:*

Information

Published : 2020-01-30 10:15

Updated : 2020-02-01 20:15

NVD link : CVE-2020-1931

Mitre link : CVE-2020-1931

JSON object : View

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Advertisement

Products Affected

apache

spamassassin

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7784", "name": "https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7784", "tags": ["Permissions Required"], "refsource": "CONFIRM"}, {"url": "https://www.debian.org/security/2020/dsa-4615", "name": "DSA-4615", "tags": [], "refsource": "DEBIAN"}, {"url": "https://seclists.org/bugtraq/2020/Feb/1", "name": "20200203 [SECURITY] [DSA 4615-1] spamassassin security update", "tags": [], "refsource": "BUGTRAQ"}, {"url": "https://usn.ubuntu.com/4265-2/", "name": "USN-4265-2", "tags": [], "refsource": "UBUNTU"}, {"url": "https://usn.ubuntu.com/4265-1/", "name": "USN-4265-1", "tags": [], "refsource": "UBUNTU"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOVVKFP2G2AF5GHAB4WMHOEX76A3H6CE/", "name": "FEDORA-2020-bd20036cdc", "tags": [], "refsource": "FEDORA"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B7SY2LUSH2X3IUXN4EQQ5A6QVUFYIV3D/", "name": "FEDORA-2020-24dac7d890", "tags": [], "refsource": "FEDORA"}, {"url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00015.html", "name": "[debian-lts-announce] 20200218 [SECURITY] [DLA 2107-1] spamassassin security update", "tags": [], "refsource": "MLIST"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00003.html", "name": "openSUSE-SU-2020:0446", "tags": [], "refsource": "SUSE"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-78"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2020-1931", "ASSIGNER": "security@apache.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "acInsufInfo": false, "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}}, "publishedDate": "2020-01-30T18:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:apache:spamassassin:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "3.4.3"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2020-02-02T04:15Z"}