From announce-return-40-archive-asf-public=cust-asf.ponee.io@spamassassin.apache.org Wed Mar 24 16:14:39 2021 Return-Path: X-Original-To: archive-asf-public@cust-asf.ponee.io Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mxout1-ec2-va.apache.org (mxout1-ec2-va.apache.org [3.227.148.255]) by mx-eu-01.ponee.io (Postfix) with ESMTPS id A84FC180630 for ; Wed, 24 Mar 2021 17:14:39 +0100 (CET) Received: from mail.apache.org (mailroute1-lw-us.apache.org [207.244.88.153]) by mxout1-ec2-va.apache.org (ASF Mail Server at mxout1-ec2-va.apache.org) with SMTP id 3226A44AAA for ; Wed, 24 Mar 2021 16:14:22 +0000 (UTC) Received: (qmail 27181 invoked by uid 500); 24 Mar 2021 16:14:21 -0000 Mailing-List: contact announce-help@spamassassin.apache.org; run by ezmlm Precedence: bulk list-help: list-unsubscribe: List-Post: List-Id: Delivered-To: mailing list announce@spamassassin.apache.org Delivered-To: moderator for announce@spamassassin.apache.org Received: (qmail 6947 invoked by uid 99); 24 Mar 2021 16:08:28 -0000 From: Sidney Markowitz Subject: [CVE-2020-1946] Apache SpamAssassin malicious rule configuration (.cf) files can be configured to run system commands Reply-To: Spamassassin Devel List To: Sidney Markowitz Message-ID: <241c47dc-467f-c622-c8ab-e06df159b475@apache.org> Date: Thu, 25 Mar 2021 05:08:23 +1300 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:78.0) Gecko/20100101 Thunderbird/78.8.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Apache SpamAssassin 3.4.5 was recently released [1], and fixes an issue of security note where malicious rule configuration (.cf) files can be configured to run system commands. In Apache SpamAssassin before 3.4.5, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.5, users should only use update channels or 3rd party .cf files from trusted places. Apache SpamAssassin would like to thank Damian Lukowski at credativ for ethically reporting this issue. This issue has been assigned CVE id CVE-2020-1946 [2] To contact the Apache SpamAssassin security team, please e-mail security at spamassassin.apache.org. For more information about Apache SpamAssassin, visit the https://spamassassin.apache.org/ web site. Apache SpamAssassin Security Team [1]: https://s.apache.org/ng9u9 [2]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-1946 -- Sidney Markowitz Chair, Apache SpamAssassin PMC sidney@apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: announce-unsubscribe@spamassassin.apache.org For additional commands, e-mail: announce-help@spamassassin.apache.org