CVE-2020-1946

Katalog CVE

CVSS 9.8 · Critical EPSS 6,1%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada apache spamassassin, debian linux +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places.

Rincian

Terbit di NVD

25 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

6,1% peluang dieksploitasi; lebih tinggi dari 93,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://s.apache.org/3r1wh mailing list · advisory vendor
• https://lists.debian.org/debian-lts-announce/2021/04/msg00000.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202105-26 advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4879 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7V2SBVTKVLFFT...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JFBFRIG5TX23N...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKAXYBKBMQOLI...