CVE-2018-11805: apache apache spamassassin
Vulnerability summary
CVE-2018-11805 is a high (CVSS 7.2) vulnerability in apache apache spamassassin. EPSS estimates a 0.91% chance of exploitation in the next 30 days, higher than 59.9% of scored vulnerabilities.
Not severe (CVSS 6.7, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 11 · Related 7Timeline
- 12-12-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from trusted places.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated6.7MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated6.7MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated6.7MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.91%
Chance of exploitation in the next 30 days
Percentile
60%
Versus all other CVEs
30-day change
Increase +0.04 pp
From 0.87% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Apache2 products
- apache spamassassinApache SpamAssassin prior to 3.4.3
- spamassassin< 3.4.3
Debian2 products
- spamassassin< 3.4.3~rc6-1
- debian_linuxEOL8.0 | 9.0 | 10.0
Alpine1 product
- spamassassin< 3.4.3-r0
Ubuntu1 product
- spamassassin< 3.4.2-0ubuntu0.14.04.1+esm1 | < 3.4.2-0ubuntu0.16.04.2 | < 3.4.2-0ubuntu0.18.04.2
4 vendors · 6 products
References
41 links- www.openwall.com/lists/oss-security/2019/12/12/1Mailing ListX Refsource MLISTThird Party AdvisoryREPORT
- svn.apache.org/repos/asf/spamassassin/branches/3.4/build/announcements/3.4.3.txtX Refsource CONFIRMMailing ListVendor AdvisoryREPORT
Show all 41 references
- lists.debian.org/debian-lts-announce/2019/12/msg00019.htmlMailing ListX Refsource MLISTThird Party Advisory