CVE-2018-11805

—

CVSS 3.1

6.7 medium

EPSS

<1%p57

Published

Dec 12, 2019 (Dec 12, 2019)

Modified

Jun 17, 2026

Description

In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from trusted places.

Vendors: apache debian
Products: spamassassin, debian linux
Weakness: CWE-78
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news0 stories

No ingested article mentions this CVE yet.