Apache Spamassassin vulnerabilities

13 CVEs affecting Apache Spamassassin, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-1946, published 2021-03-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2006-2447, published 2006-06-06. Medium severity, CVSS 5.1. EPSS: 75.8% chance of exploitation in the next 30 days. SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when…
CVE-2018-11780, published 2018-09-17. Critical severity, CVSS 9.8. EPSS: 10.8% chance of exploitation in the next 30 days. A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.
CVE-2005-1266, published 2005-06-15. Medium severity, CVSS 5.0. EPSS: 8.3% chance of exploitation in the next 30 days. Apache SpamAssassin 3.0.1, 3.0.2, and 3.0.3 allows remote attackers to cause a denial of service (CPU consumption and slowdown) via a message with a long Content-Type header without any boundaries.
CVE-2017-15705, published 2018-09-17. Medium severity, CVSS 5.3. EPSS: 7.9% chance of exploitation in the next 30 days. A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled…
CVE-2005-3351, published 2005-11-20. Medium severity, CVSS 5.0. EPSS: 7.3% chance of exploitation in the next 30 days. SpamAssassin 3.0.4 allows attackers to bypass spam detection via an e-mail with a large number of recipients ("To" addresses), which triggers a bus error in Perl.
CVE-2019-12420, published 2019-12-12. High severity, CVSS 7.5. EPSS: 7.2% chance of exploitation in the next 30 days. In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared…
CVE-2020-1930, published 2020-01-30. High severity, CVSS 8.1. EPSS: 7.1% chance of exploitation in the next 30 days. A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run system commands similar to…
CVE-2007-0451, published 2007-02-16. Medium severity, CVSS 4.3. EPSS: 6.9% chance of exploitation in the next 30 days. Apache SpamAssassin before 3.1.8 allows remote attackers to cause a denial of service via long URLs in malformed HTML, which triggers "massive memory usage."
CVE-2020-1931, published 2020-01-30. High severity, CVSS 8.1. EPSS: 6.5% chance of exploitation in the next 30 days. A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805.…
CVE-2020-1946, published 2021-03-25. Critical severity, CVSS 9.8. EPSS: 6.1% chance of exploitation in the next 30 days. In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of…

Latest

CVE-2018-11805, published 2019-12-12. Medium severity, CVSS 6.7. EPSS: 0.9% chance of exploitation in the next 30 days. In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In…
CVE-2018-11781, published 2018-09-17. High severity, CVSS 7.8. EPSS: 1% chance of exploitation in the next 30 days. Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.
CVE-2016-1238, published 2016-08-02. High severity, CVSS 7.8. EPSS: 0.8% chance of exploitation in the next 30 days. (1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7)…