OS command injection in Apache SpamAssassin
Priority LOW 31CWE-78Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-78.
Summary
In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from trusted places.
Why it matters now
EPSS 0.00907 60th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache SpamAssassin | Apache SpamAssassin prior to 3.4.3 | — | No fix listed | CNA |
- Apache SpamAssassin VendorApache Affected Apache SpamAssassin prior to 3.4.3 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:spamassassin:*:*:*:*:*:*:*:* | before 3.4.3 | Vulnerable | Apache |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
- cpe:2.3:a:apache:spamassassin:*:*:*:*:*:*:*:* Versions before 3.4.3 Vulnerable ·Apache
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Remediation
Red Hat 1 advisory
- RHSA-2020:4625 Released 2020-11-04 · Red Hat rating Moderatespamassassin security update
- Red Hat Enterprise Linux AppStream (v. 8) spamassassin-3.4.2-10.el8
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Apache SpamAssassin — USN-4237-1
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2019-09265 Uncontrolled resource consumption in Apache SpamAssassinPriority MEDIUM 43
- Advisory ·
Apache SpamAssassin — USN-4237-2
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2019-09265 Uncontrolled resource consumption in Apache SpamAssassinPriority MEDIUM 43
Show 1 more group
- Advisory ·
Apache SpamAssassin — DSA-4584
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2019-09265 Uncontrolled resource consumption in Apache SpamAssassinPriority MEDIUM 43
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:4625 |
Timeline
- 2026-10-02 Threatist record created from CVE-2018-11805
- 2026-10-03 Alias added: GHSA-639c-xqgw-3jh5
References
Advisory 9
- [oss-security] 20191212 Apache SpamAssassin v3.4.3 released with fix for CVE-2018-11805
- https://seclists.org/oss-sec/2019/q4/154
- https://svn.apache.org/repos/asf/spamassassin/branches/3.4/build/announcements/3.4.3.txt
- DSA-4584
- 20191216 [SECURITY] [DSA 4584-1] spamassassin security update
- [debian-lts-announce] 20191216 [SECURITY] [DLA 2037-1] spamassassin security update
- USN-4237-1
- USN-4237-2
- openSUSE-SU-2020:0446
Other 20
- [spamassassin-users] 20191212 [SECURITY] Apache SpamAssassin v3.4.3 released with fix for CVE-2018-11805
- [spamassassin-dev] 20191212 [SECURITY] Apache SpamAssassin v3.4.3 released with fix for CVE-2018-11805
- [spamassassin-announce] 20191212 [SECURITY] Apache SpamAssassin v3.4.3 released with fix for CVE-2018-11805
- [announce] 20191212 [SECURITY] Apache SpamAssassin v3.4.3 released with fix for CVE-2018-11805
- https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7647
- [spamassassin-users] 20191218 CVE-2018-11805 fix and sa-exim
- [spamassassin-users] 20191218 Re: CVE-2018-11805 fix and sa-exim
- [spamassassin-users] 20191219 Re: CVE-2018-11805 fix and sa-exim
- [spamassassin-dev] 20200130 [CVE-2020-1931] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands with warnings.
- [spamassassin-announce] 20200130 [CVE-2020-1931] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands with warnings.
- [spamassassin-users] 20200130 [CVE-2020-1931] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands with warnings.
- [spamassassin-users] 20200130 [CVE-2020-1930] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands
- [spamassassin-announce] 20200130 [CVE-2020-1930] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands
- [announce] 20200130 [CVE-2020-1931] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands with warnings.
- [spamassassin-dev] 20200130 [CVE-2020-1930] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands
- [oss-security] 20200130 [CVE-2020-1930] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands
- [oss-security] 20200130 [CVE-2020-1931] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands with warnings.
- [spamassassin-users] 20200130 Re: ANNOUNCE: Apache SpamAssassin 3.4.4 available
- [announce] 20200130 [CVE-2020-1930] Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands
- [spamassassin-users] 20200131 Re: ANNOUNCE: Apache SpamAssassin 3.4.4 available
More Apache Spamassassin vulnerabilities
- TI-2006-02383 SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch… CVSS 2.0MEDIUM 5.1
- TI-2018-08437 A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2. CVSS 3.0CRITICAL 9.8
- TI-2020-01870 Apache SpamAssassin has an OS Command Injection vulnerability CVSS 3.1CRITICAL 9.8
- TI-2020-01855 OS command injection in Apache SpamAssassin CVSS 3.1HIGH 8.1
- TI-2020-01854 OS command injection in Apache SpamAssassin CVSS 3.1HIGH 8.1
- TI-2019-09265 Uncontrolled resource consumption in Apache SpamAssassin CVSS 3.1HIGH 7.5
Sources
- CVE-2018-11805 · CVE Program
- CVE-2018-11805 · NVD
- FIRST EPSS
- GHSA-639c-xqgw-3jh5 · GitHub Advisory Database · CC BY 4.0
- CVE-2018-11805 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences