Home > Vulnerability Database > CVE-2018-11805

Mend.io Vulnerability Database

CVE-2018-11805

Date: December 12, 2019

In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from trusted places.

Severity Score

6.7

Related Resources (35)

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2018-11805

Url: https://lists.apache.org/thread.html/r71f789fcd6339144e3d4db8f4128def12c341e638bd0107a0b82a05b%40%3Cannounce.spamassassin.apache.org%3E

Url: https://lists.apache.org/thread.html/rc4df9835fb2d7b5bb1202fca99a1de21a40acef055661d3a9e8ae781%40%3Cusers.spamassassin.apache.org%3E

Url: https://lists.debian.org/debian-lts-announce/2019/12/msg00019.html

Url: https://usn.ubuntu.com/4237-2/

Url: https://lists.apache.org/thread.html/6f89f82a573ea616dce53ec67e52d963618a9f9ac71da5c1efdbd166%40%3Cusers.spamassassin.apache.org%3E

Url: http://www.openwall.com/lists/oss-security/2020/01/30/3

Url: https://www.debian.org/security/2019/dsa-4584

Url: http://www.openwall.com/lists/oss-security/2020/01/30/2

Url: https://nvd.nist.gov/vuln/detail/CVE-2018-11805

Url: https://seclists.org/bugtraq/2019/Dec/27

Url: https://lists.apache.org/thread.html/r6729f3d3be754a06c39bb4f11c925a3631e8ea2b4c865546d755cb0a%40%3Cdev.spamassassin.apache.org%3E

Url: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00003.html

Url: https://lists.apache.org/thread.html/r2578c486552637bfedbe624940cc60d6463bd90044c887bdebb75e74%40%3Cusers.spamassassin.apache.org%3E

Url: http://www.openwall.com/lists/oss-security/2019/12/12/1

Url: https://lists.apache.org/thread.html/0b5c73809d0690527341d940029f743807b70550050fd23ee869c5e5%40%3Cusers.spamassassin.apache.org%3E

Url: https://svn.apache.org/repos/asf/spamassassin/branches/3.4/build/announcements/3.4.3.txt

Url: https://lists.apache.org/thread.html/r217177f7de36deab36dab88db4b6448961122571176dd4b2c133d08e%40%3Cannounce.spamassassin.apache.org%3E

Url: https://lists.apache.org/thread.html/d015dc5b4f24fd6777a85d068502a9c5d58d69d877ed5b0eb9a22cd5%40%3Cdev.spamassassin.apache.org%3E

Url: https://security.alpinelinux.org/vuln/CVE-2018-11805

Url: https://security-tracker.debian.org/tracker/CVE-2018-11805

Url: https://lists.apache.org/thread.html/rc4df9835fb2d7b5bb1202fca99a1de21a40acef055661d3a9e8ae781%40%3Cannounce.apache.org%3E

Url: https://usn.ubuntu.com/4237-1/

Url: https://lists.apache.org/thread.html/bc58907171c6585e5875a3ce86066d4956c218911cb74e3156de4433%40%3Cannounce.apache.org%3E

Url: https://lists.apache.org/thread.html/rc4df9835fb2d7b5bb1202fca99a1de21a40acef055661d3a9e8ae781%40%3Cdev.spamassassin.apache.org%3E

Url: https://lists.apache.org/thread.html/c1f59b7e13b7f2c12f847f7d0dec2636df3cdbcaa6d8309007395ff4%40%3Cusers.spamassassin.apache.org%3E

Url: https://access.redhat.com/security/cve/CVE-2018-11805

Url: https://lists.apache.org/thread.html/r6729f3d3be754a06c39bb4f11c925a3631e8ea2b4c865546d755cb0a%40%3Cusers.spamassassin.apache.org%3E

Url: https://seclists.org/oss-sec/2019/q4/154

Url: https://lists.apache.org/thread.html/r6729f3d3be754a06c39bb4f11c925a3631e8ea2b4c865546d755cb0a%40%3Cannounce.apache.org%3E

Url: https://lists.apache.org/thread.html/8534b60bae95ac3a8a4adb840f4ab26135f1c973ce197ff44439cbae%40%3Cusers.spamassassin.apache.org%3E

Url: https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7647

Url: https://lists.apache.org/thread.html/2946b38caec47f7f6a79e8e03d2aa723794186e59a7dc6b5e76dfc18%40%3Cannounce.spamassassin.apache.org%3E

Url: https://lists.apache.org/thread.html/r3d32ebf97b1245b8237763444e911c4595d2ad5e34a1641840d8146f%40%3Cusers.spamassassin.apache.org%3E

Url: https://www.mend.io/vulnerability-database/CVE-2018-11805

Severity Score

6.7

Weakness Type (CWE)

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78

CVSS v3.1

Base Score:	6.7
Attack Vector (AV):	LOCAL
Attack Complexity (AC):	LOW
Privileges Required (PR):	HIGH
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

CVSS v2

Base Score:	7.2
Access Vector (AV):	LOCAL
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	COMPLETE
Integrity (I):	COMPLETE
Availability (A):	COMPLETE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2018-11805

Date: December 12, 2019

Severity Score

Related Resources (35)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?