Stay Secure with the Latest Linux Advisories

security advisorymoderateupgrade

Mageia: 2021-0182 Moderate: Apache SpamAssassin Command Exploitation

In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places. (CVE-2020-1946) . MGASA-2021-0182 - Updated spamassassin packages fix security vulnerability Publication date: 12 Apr 2021 URL: https://advisories.mageia.org/MGASA-2021-0182.html Type: security Affected Mageia releases: 7, 8 CVE: CVE-2020-1946 In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places. (CVE-2020-1946) References: - https://bugs.mageia.org/show_bug.cgi?id=28673 - https://spamassassin.apache.org/news.html - https://svn.apache.org/repos/asf/spamassassin/branches/3.4/build/announcements/3.4.5.txt - https://www.openwall.com/lists/oss-security/2021/03/24/3 - https://www.cve.org/CVERecord?id=CVE-2020-1946 SRPMS: - 7/core/spamassassin-3.4.5-1.mga7 - 7/core/spamassassin-rules-3.4.5-1.mga7 - 8/core/spamassassin-3.4.5-1.mga8 - 8/core/spamassassin-rules-3.4.5-1.mga8 . Mitigate potential vulnerabilities in Apache SpamAssassin through the MGASA-2021-0182 patch for Mageia distributions. Prioritize your safety!. Apache, Command Injection, Security Update, SpamAssassin, Mageia. . LinuxSecurity.com Team

Apr 12, 2021 Mageia