Описание
sa-exim 4.2.1 allows attackers to execute arbitrary code if they can write a .cf file or a rule. This occurs because Greylisting.pm relies on eval (rather than direct parsing and/or use of the taint feature). This issue is similar to CVE-2018-11805.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| sa-exim | fixed | 4.2.1-19 | package | |
| sa-exim | no-dsa | buster | package | |
| sa-exim | no-dsa | stretch | package |
Примечания
https://bugs.debian.org/946829#24
https://marc.info/?l=spamassassin-users&m=157668107325768&w=2
https://marc.info/?l=spamassassin-users&m=157668305026635&w=2
The issue is "effectively" mitigating due to the CVE-2018-11805 fix in
spamassassin, making the Greylisting.pm non-functional (and so a functional
regression as well as tracked in #946829). The security implications are
as well documented in /usr/share/doc/sa-exim/README.greylisting.gz
EPSS
Связанные уязвимости
sa-exim 4.2.1 allows attackers to execute arbitrary code if they can write a .cf file or a rule. This occurs because Greylisting.pm relies on eval (rather than direct parsing and/or use of the taint feature). This issue is similar to CVE-2018-11805.
sa-exim 4.2.1 allows attackers to execute arbitrary code if they can write a .cf file or a rule. This occurs because Greylisting.pm relies on eval (rather than direct parsing and/or use of the taint feature). This issue is similar to CVE-2018-11805.
sa-exim 4.2.1 allows attackers to execute arbitrary code if they can write a .cf file or a rule. This occurs because Greylisting.pm relies on eval (rather than direct parsing and/or use of the taint feature). This issue is similar to CVE-2018-11805.
EPSS