CVE-2020-1946 log
| Source |
|
| Severity | High |
| Remote | Yes |
| Type | Arbitrary command execution |
| Description | In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to pamAssassin version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places. |
| Group | Package | Affected | Fixed | Severity | Status | Ticket |
|---|---|---|---|---|---|---|
| AVG-1731 | spamassassin | 3.4.4-3 | 3.4.5-1 | High | Fixed |