MGASA-2019-0406

Advisory lineage Upstream: 2 Downstream: 0
Published: 24 Dec 2019, 12:24
Last modified:16 Apr 2026, 04:26

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

24 Dec 2019, 12:24
Published
Vulnerability first disclosed
16 Apr 2026, 04:26
Last Modified
Vulnerability information updated

Description

Updated spamassassin packages fix security vulnerabilities The updated packages fix security vulnerabilities: In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rdparty .cf files from trusted places. (CVE-2018-11805) In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly. (CVE-2019-12420)

Affected Systems

  • mageia•spamassassin

    < 3.4.3-1.mga7

  • mageia•spamassassin-rules

    < 3.4.3-1.mga7

References (6)