Red Hat Security Advisory

RHSA-2020:4625

spamassassin security update

Released 2020-11-04 · Red Hat rating Moderate · View on Red Hat →

Fixed in

TI-2020-01855 CVE-2020-1931 · GHSA-p22p-qh9c-7725

MEDIUM 45

A command execution issue was found in Apache SpamAssassin prior to 3.4.3.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.06464 Published 2020-01-30 Partial fix · 3.4.3 CWE-78

TI-2020-01854 CVE-2020-1930 · GHSA-pxq8-92ff-q845

MEDIUM 45

A command execution issue was found in Apache SpamAssassin prior to 3.4.3.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.07053 Published 2020-01-30 Partial fix · 3.4.3 CWE-78

TI-2019-09265 CVE-2019-12420 · GHSA-q6ww-c56f-5fhw

MEDIUM 43

In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07234 Published 2019-12-12 Partial fix CWE-400

TI-2018-08459 CVE-2018-11805 · GHSA-639c-xqgw-3jh5

LOW 31

In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00907 Published 2019-12-12 Partial fix CWE-78