Uncontrolled resource consumption in Apache SpamAssassin
Priority MEDIUM 43CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 4 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-400.
Summary
In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly.
Why it matters now
EPSS 0.07234 94th percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 4 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache SpamAssassin | Apache SpamAssassin prior to 3.4.3 | — | No fix listed | CNA |
- Apache SpamAssassin VendorApache Affected Apache SpamAssassin prior to 3.4.3 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:spamassassin:*:*:*:*:*:*:*:* | before 3.4.3 | Vulnerable | Apache |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
- cpe:2.3:a:apache:spamassassin:*:*:*:*:*:*:*:* Versions before 3.4.3 Vulnerable ·Apache
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Remediation
Red Hat 2 advisories
- RHSA-2020:4625 Released 2020-11-04 · Red Hat rating Moderatespamassassin security update
- Red Hat Enterprise Linux AppStream (v. 8) spamassassin-3.4.2-10.el8
- RHSA-2020:3973 Released 2020-09-29 · Red Hat rating Moderatespamassassin security update
- Red Hat Enterprise Linux Client Optional (v. 7) spamassassin-3.4.0-6.el7
- Red Hat Enterprise Linux Server (v. 7) spamassassin-3.4.0-6.el7
- Red Hat Enterprise Linux Workstation (v. 7) spamassassin-3.4.0-6.el7
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Apache SpamAssassin — USN-4237-1
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2018-08459 OS command injection in Apache SpamAssassinPriority LOW 31
- Advisory ·
Apache SpamAssassin — USN-4237-2
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2018-08459 OS command injection in Apache SpamAssassinPriority LOW 31
Show 1 more group
- Advisory ·
Apache SpamAssassin — DSA-4584
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2018-08459 OS command injection in Apache SpamAssassinPriority LOW 31
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:4625 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2020:3973 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2020:3973 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:3973 |
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12420
- 2026-10-03 Alias added: GHSA-q6ww-c56f-5fhw
References
Advisory 7
- [oss-security] 20191212 Apache SpamAssassin v3.4.3 released with fix for CVE-2019-12420
- https://svn.apache.org/repos/asf/spamassassin/branches/3.4/build/announcements/3.4.3.txt
- DSA-4584
- 20191216 [SECURITY] [DSA 4584-1] spamassassin security update
- [debian-lts-announce] 20191216 [SECURITY] [DLA 2037-1] spamassassin security update
- USN-4237-1
- USN-4237-2
Other 7
- [spamassassin-announce] 20191212 [SECURITY] Apache SpamAssassin v3.4.3 released with fix for CVE-2019-12420
- [spamassassin-dev] 20191212 [SECURITY] Apache SpamAssassin v3.4.3 released with fix for CVE-2019-12420
- [spamassassin-users] 20191212 [SECURITY] Apache SpamAssassin v3.4.3 released with fix for CVE-2019-12420
- [announce] 20191212 [SECURITY] Apache SpamAssassin v3.4.3 released with fix for CVE-2019-12420
- https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7747
- [spamassassin-users] 20200130 Re: ANNOUNCE: Apache SpamAssassin 3.4.4 available
- [spamassassin-users] 20200131 Re: ANNOUNCE: Apache SpamAssassin 3.4.4 available
More Apache Spamassassin vulnerabilities
- TI-2006-02383 SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch… CVSS 2.0MEDIUM 5.1
- TI-2018-08437 A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2. CVSS 3.0CRITICAL 9.8
- TI-2020-01870 Apache SpamAssassin has an OS Command Injection vulnerability CVSS 3.1CRITICAL 9.8
- TI-2020-01855 OS command injection in Apache SpamAssassin CVSS 3.1HIGH 8.1
- TI-2020-01854 OS command injection in Apache SpamAssassin CVSS 3.1HIGH 8.1
- TI-2018-08438 Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax. CVSS 3.0HIGH 7.8
Sources
- CVE-2019-12420 · CVE Program
- CVE-2019-12420 · NVD
- FIRST EPSS
- GHSA-q6ww-c56f-5fhw · GitHub Advisory Database · CC BY 4.0
- CVE-2019-12420 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences