Every CVE Search/ Get API key

CVE-2018-11805

In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands...

6.7 MediumFix available

In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from trusted places.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.91%Down 15.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.7

In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from trusted places.

Record
CVE-2018-11805
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-78
Updated
2026-11-02
CVE List No score

In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from trusted places.

Record
CVE-2018-11805
Updated
2026-11-02
EUVDEUVD-2018-3797 No score

In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from trusted places.

Record
EUVD-2018-3797
Updated
2026-11-03
GitHub AdvisoriesGHSA-639c-xqgw-3jh5 6.7

In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands...

In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from trusted places.

Record
GHSA-639c-xqgw-3jh5
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
OSVALPINE-CVE-2018-11805 6.7

In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from trusted places.

Record
ALPINE-CVE-2018-11805
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 6.7

In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from trusted places.

Record
CVE-2018-11805
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 13 moreShow less
OSVDEBIAN-CVE-2018-11805 6.7

In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from trusted places.

Record
DEBIAN-CVE-2018-11805
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:4625 7.5

Red Hat Security Advisory: spamassassin security update

Record
RHSA-2020:4625
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-11805 6.7

In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from trusted places.

Record
UBUNTU-CVE-2018-11805
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2026-1777548876 No score

spamassassin: Fix of CVE-2018-11805

  • CVE-2018-11805: require --reallyallowplugins for sa-update --allowplugins to mitigate plugin injection from updates
Record
CLSA-2026-1777548876
Updated
2026-11-02
OSVCLSA-2026-1777548877 No score

spamassassin: Fix of CVE-2018-11805

  • CVE-2018-11805: require --reallyallowplugins for sa-update --allowplugins to mitigate plugin injection from updates
Record
CLSA-2026-1777548877
Updated
2026-11-02
OSVMGASA-2019-0406 No score

Updated spamassassin packages fix security vulnerabilities

The updated packages fix security vulnerabilities:

In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rdparty .cf files from trusted places. (CVE-2018-11805)

In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly. (CVE-2019-12420)

Record
MGASA-2019-0406
Updated
2026-11-02
OSVopenSUSE-SU-2020:0446-1 No score

Security update for spamassassin

This update for spamassassin fixes the following issues:

Security issues fixed:

  • CVE-2018-11805: Fixed an issue with delimiter handling in rule files related to is_regexp_valid() (bsc#1118987).
  • CVE-2020-1930: Fixed an issue with rule configuration (.cf) files which can be configured to run system commands (bsc#1162197).
  • CVE-2020-1931: Fixed an issue with rule configuration (.cf) files which can be configured to run system commands with warnings (bsc#1162200).

Non-security issue fixed:

  • Altering hash requires restarting loop (bsc#862963).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

Record
openSUSE-SU-2020:0446-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11395-1 No score

perl-Mail-SpamAssassin-3.4.6-71.3 on GA media

These are all security issues fixed in the perl-Mail-SpamAssassin-3.4.6-71.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11395-1
Updated
2026-11-02
OSVSUSE-SU-2020:0810-1 No score

Security update for spamassassin

This update for spamassassin fixes the following issues:

  • CVE-2018-11805: Fixed an issue with delimiter handling in rule files related to is_regexp_valid() (bsc#1118987).
  • CVE-2020-1930: Fixed an issue with rule configuration (.cf) files which can be configured to run system commands (bsc#1162197).
  • CVE-2020-1931: Fixed an issue with rule configuration (.cf) files which can be configured to run system commands with warnings (bsc#1162200).
Record
SUSE-SU-2020:0810-1
Updated
2026-11-02
OSVSUSE-SU-2020:0811-1 No score

Security update for spamassassin

This update for spamassassin fixes the following issues:

Security issues fixed:

  • CVE-2018-11805: Fixed an issue with delimiter handling in rule files related to is_regexp_valid() (bsc#1118987).
  • CVE-2020-1930: Fixed an issue with rule configuration (.cf) files which can be configured to run system commands (bsc#1162197).
  • CVE-2020-1931: Fixed an issue with rule configuration (.cf) files which can be configured to run system commands with warnings (bsc#1162200).

Non-security issue fixed:

  • Altering hash requires restarting loop (bsc#862963).
Record
SUSE-SU-2020:0811-1
Updated
2026-11-02
OSVSUSE-SU-2020:0813-1 No score

Security update for spamassassin

This update for spamassassin fixes the following issues:

Security issues fixed:

  • CVE-2018-11805: Fixed an issue with delimiter handling in rule files related to is_regexp_valid() (bsc#1118987).
  • CVE-2020-1930: Fixed an issue with rule configuration (.cf) files which can be configured to run system commands (bsc#1162197).
  • CVE-2020-1931: Fixed an issue with rule configuration (.cf) files which can be configured to run system commands with warnings (bsc#1162200).

Non-security issue fixed:

  • Altering hash requires restarting loop (bsc#862963).
Record
SUSE-SU-2020:0813-1
Updated
2026-11-02
OSVUSN-4237-1 No score

spamassassin vulnerabilities

It was discovered that SpamAssassin incorrectly handled certain CF files. If a user or automated system were tricked into using a specially-crafted CF file, a remote attacker could possibly run arbitrary code. (CVE-2018-11805)

It was discovered that SpamAssassin incorrectly handled certain messages. A remote attacker could possibly use this issue to cause SpamAssassin to consume resources, resulting in a denial of service. (CVE-2019-12420)

Record
USN-4237-1
Updated
2026-11-02
OSVUSN-4237-2 No score

spamassassin vulnerabilities

USN-4237-1 fixed several vulnerabilities in SpamAssassin. This update provides the corresponding update for Ubuntu 12.04 ESM and 14.04 ESM.

Original advisory details:

It was discovered that SpamAssassin incorrectly handled certain CF files. If a user or automated system were tricked into using a specially-crafted CF file, a remote attacker could possibly run arbitrary code. (CVE-2018-11805)

It was discovered that SpamAssassin incorrectly handled certain messages. A remote attacker could possibly use this issue to cause SpamAssassin to consume resources, resulting in a denial of service. (CVE-2019-12420)

Record
USN-4237-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
spamassassin
Alpine:v3.10
 before 3.4.3-r0
3.4.3-r0
spamassassin
Alpine:v3.11
 before 3.4.3-r0
3.4.3-r0
spamassassin
Alpine:v3.12
 before 3.4.3-r0
3.4.3-r0
spamassassin
Alpine:v3.13
 before 3.4.3-r0
3.4.3-r0
spamassassin
Alpine:v3.14
 before 3.4.3-r0
3.4.3-r0
spamassassin
Alpine:v3.15
 before 3.4.3-r0
3.4.3-r0
spamassassin
Alpine:v3.16
 before 3.4.3-r0
3.4.3-r0
spamassassin
Alpine:v3.17
 before 3.4.3-r0
3.4.3-r0
spamassassin
Alpine:v3.18
 before 3.4.3-r0
3.4.3-r0
spamassassin
Alpine:v3.19
 before 3.4.3-r0
3.4.3-r0
Show 51 moreShow less
Affected packages
PackageAffectedFixed
spamassassin
Alpine:v3.20
 before 3.4.3-r0
3.4.3-r0
spamassassin
Alpine:v3.21
 before 3.4.3-r0
3.4.3-r0
spamassassin
Alpine:v3.22
 before 3.4.3-r0
3.4.3-r0
spamassassin
Alpine:v3.23
 before 3.4.3-r0
3.4.3-r0
spamassassin
Alpine:v3.24
 before 3.4.3-r0
3.4.3-r0
spamassassin
Alpine:v3.8
 before 3.4.3-r0
3.4.3-r0
spamassassin
Alpine:v3.9
 before 3.4.3-r0
3.4.3-r0
spamassassin
TuxCare:OracleLinux:6
 before 3.3.1-3.el6.tuxcare.els3
3.3.1-3.el6.tuxcare.els3
spamassassin
TuxCare:CentOS:6
 before 3.3.1-3.el6.tuxcare.els3
3.3.1-3.el6.tuxcare.els3
spamassassin
Debian:12
 before 3.4.3~rc6-1
3.4.3~rc6-1
spamassassin
Debian:13
 before 3.4.3~rc6-1
3.4.3~rc6-1
spamassassin
Debian:14
 before 3.4.3~rc6-1
3.4.3~rc6-1
spamassassin
Debian:8
From an advisory covering 2 CVEs
 before 3.4.2-0+deb8u2, plus listed versions
3.4.0-63.4.1-13.4.1-23.4.1-33.4.1-3~bpo8+1
Show 8 moreShow less
3.4.1-43.4.1-53.4.1-5.13.4.1-63.4.1-6~bpo8+13.4.1-73.4.1-83.4.2-0+deb8u1
3.4.2-0+deb8u2
spamassassin
Debian:9
From an advisory covering 2 CVEs
 before 3.4.2-1~deb9u2, plus listed versions
3.4.1-63.4.1-6+deb9u13.4.1-73.4.1-83.4.2-1~deb9u1
3.4.2-1~deb9u2
spamassassin
Debian:10
From an advisory covering 2 CVEs
 before 3.4.2-1+deb10u1, plus listed versions
3.4.2-1
3.4.2-1+deb10u1
spamassassin
Mageia:7
From an advisory covering 2 CVEs
 before 3.4.3-1.mga7
3.4.3-1.mga7
spamassassin-rules
Mageia:7
From an advisory covering 2 CVEs
 before 3.4.3-1.mga7
3.4.3-1.mga7
spamassassin
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:3.4.2-10.el8
0:3.4.2-10.el8
spamassassin-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:3.4.2-10.el8
0:3.4.2-10.el8
spamassassin-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:3.4.2-10.el8
0:3.4.2-10.el8
spamassassin
SUSE:HPE Helion OpenStack 8
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:OpenStack Cloud 7
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:OpenStack Cloud 8
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server 12 SP1-LTSS
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Enterprise Storage 5
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 3 CVEs
 before 3.4.2-12.5.1
3.4.2-12.5.1
spamassassin
SUSE:Linux Enterprise Module for Development Tools 15 SP1
From an advisory covering 3 CVEs
 before 3.4.2-12.5.1
3.4.2-12.5.1
spamassassin
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 3 CVEs
 before 3.4.2-7.9.1
3.4.2-7.9.1
spamassassin
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 3 CVEs
 before 3.4.2-7.9.1
3.4.2-7.9.1
spamassassin
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 3 CVEs
 before 3.4.2-7.9.1
3.4.2-7.9.1
spamassassin
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 3 CVEs
 before 3.4.2-7.9.1
3.4.2-7.9.1
spamassassin
Ubuntu:Pro:14.04:LTS
 before 3.4.2-0ubuntu0.14.04.1+esm1, plus listed versions
3.3.2-6ubuntu23.3.2-8ubuntu13.3.2-8ubuntu23.4.0-13.4.0-1ubuntu13.4.0-1ubuntu23.4.0-1ubuntu2.13.4.2-0ubuntu0.14.04.1
3.4.2-0ubuntu0.14.04.1+esm1
spamassassin
Ubuntu:16.04:LTS
 before 3.4.2-0ubuntu0.16.04.2, plus listed versions
3.4.1-13.4.1-23.4.1-33.4.2-0ubuntu0.16.04.1
3.4.2-0ubuntu0.16.04.2
spamassassin
Ubuntu:18.04:LTS
 before 3.4.2-0ubuntu0.18.04.2, plus listed versions
3.4.1-73.4.1-83.4.1-8build13.4.2-0ubuntu0.18.04.1
3.4.2-0ubuntu0.18.04.2
spamassassin
Ubuntu:16.04:LTS
From an advisory covering 2 CVEs
 before 3.4.2-0ubuntu0.16.04.2, plus listed versions
3.4.1-13.4.1-23.4.1-33.4.2-0ubuntu0.16.04.1
3.4.2-0ubuntu0.16.04.2
spamassassin
Ubuntu:18.04:LTS
From an advisory covering 2 CVEs
 before 3.4.2-0ubuntu0.18.04.2, plus listed versions
3.4.1-73.4.1-83.4.1-8build13.4.2-0ubuntu0.18.04.1
3.4.2-0ubuntu0.18.04.2
spamassassin
Ubuntu:Pro:14.04:LTS
From an advisory covering 2 CVEs
 before 3.4.2-0ubuntu0.14.04.1+esm1, plus listed versions
3.3.2-6ubuntu23.3.2-8ubuntu13.3.2-8ubuntu23.4.0-13.4.0-1ubuntu13.4.0-1ubuntu23.4.0-1ubuntu2.13.4.2-0ubuntu0.14.04.1
3.4.2-0ubuntu0.14.04.1+esm1
spamassassin
openSUSE:Leap 15.1
From an advisory covering 3 CVEs
 before 3.4.2-lp151.8.3.1
3.4.2-lp151.8.3.1
spamassassin
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 3.4.6-71.3
3.4.6-71.3

History

History
RecordedChangedSources
affected, facts
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-11805 is a medium vulnerability (CVSS 6.7) in Apache Spamassassin, published December 12, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. Fixed in spamassassin 3.4.3-r0.

References

Show 81 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open