CVE-2019-12420
In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources...
In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly.
- Record
CVE-2019-12420- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly.
- Record
CVE-2019-12420- Updated
- 2026-11-02
EUVDEUVD-2019-4033 No score
In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly.
- Record
EUVD-2019-4033- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q6ww-c56f-5fhw
In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources...
In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly.
- Record
GHSA-q6ww-c56f-5fhw- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVALPINE-CVE-2019-12420
In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly.
- Record
ALPINE-CVE-2019-12420- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly.
- Record
CVE-2019-12420- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 12 moreShow less
OSVDEBIAN-CVE-2019-12420
In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly.
- Record
DEBIAN-CVE-2019-12420- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2020:3973
Red Hat Security Advisory: spamassassin security update
- Record
RHSA-2020:3973- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2020:4625
Red Hat Security Advisory: spamassassin security update
- Record
RHSA-2020:4625- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-12420
In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly.
- Record
UBUNTU-CVE-2019-12420- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0406 No score
Updated spamassassin packages fix security vulnerabilities
The updated packages fix security vulnerabilities:
In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rdparty .cf files from trusted places. (CVE-2018-11805)
In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly. (CVE-2019-12420)
- Record
MGASA-2019-0406- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0551-1 No score
Security update for spamassassin
This update for spamassassin fixes the following issues:
- CVE-2019-12420: memory leak via crafted messages (bsc#1159133)
- CVE-2020-1946: security update (bsc#1184221)
This update was imported from the SUSE:SLE-15-SP1:Update update project.
- Record
openSUSE-SU-2021:0551-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11395-1 No score
perl-Mail-SpamAssassin-3.4.6-71.3 on GA media
These are all security issues fixed in the perl-Mail-SpamAssassin-3.4.6-71.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11395-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1152-1 No score
Security update for spamassassin
This update for spamassassin fixes the following issues:
- spamassassin was updated to version 3.4.5
- CVE-2019-12420: memory leak via crafted messages (bsc#1159133)
- CVE-2020-1946: security update (bsc#1184221)
- Record
SUSE-SU-2021:1152-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1153-1 No score
Security update for spamassassin
This update for spamassassin fixes the following issues:
- CVE-2019-12420: memory leak via crafted messages (bsc#1159133)
- CVE-2020-1946: security update (bsc#1184221)
- Record
SUSE-SU-2021:1153-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1163-1 No score
Security update for spamassassin
This update for spamassassin fixes the following issues:
- CVE-2019-12420: memory leak via crafted messages (bsc#1159133)
- CVE-2020-1946: security update (bsc#1184221)
- Record
SUSE-SU-2021:1163-1- Updated
- 2026-11-02
OSVUSN-4237-1 No score
spamassassin vulnerabilities
It was discovered that SpamAssassin incorrectly handled certain CF files. If a user or automated system were tricked into using a specially-crafted CF file, a remote attacker could possibly run arbitrary code. (CVE-2018-11805)
It was discovered that SpamAssassin incorrectly handled certain messages. A remote attacker could possibly use this issue to cause SpamAssassin to consume resources, resulting in a denial of service. (CVE-2019-12420)
- Record
USN-4237-1- Updated
- 2026-11-02
OSVUSN-4237-2 No score
spamassassin vulnerabilities
USN-4237-1 fixed several vulnerabilities in SpamAssassin. This update provides the corresponding update for Ubuntu 12.04 ESM and 14.04 ESM.
Original advisory details:
It was discovered that SpamAssassin incorrectly handled certain CF files. If a user or automated system were tricked into using a specially-crafted CF file, a remote attacker could possibly run arbitrary code. (CVE-2018-11805)
It was discovered that SpamAssassin incorrectly handled certain messages. A remote attacker could possibly use this issue to cause SpamAssassin to consume resources, resulting in a denial of service. (CVE-2019-12420)
- Record
USN-4237-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
spamassassinAlpine:v3.10 |
before 3.4.3-r0 | 3.4.3-r0 |
spamassassinAlpine:v3.11 |
before 3.4.3-r0 | 3.4.3-r0 |
spamassassinAlpine:v3.12 |
before 3.4.3-r0 | 3.4.3-r0 |
spamassassinAlpine:v3.13 |
before 3.4.3-r0 | 3.4.3-r0 |
spamassassinAlpine:v3.14 |
before 3.4.3-r0 | 3.4.3-r0 |
spamassassinAlpine:v3.15 |
before 3.4.3-r0 | 3.4.3-r0 |
spamassassinAlpine:v3.16 |
before 3.4.3-r0 | 3.4.3-r0 |
spamassassinAlpine:v3.17 |
before 3.4.3-r0 | 3.4.3-r0 |
spamassassinAlpine:v3.18 |
before 3.4.3-r0 | 3.4.3-r0 |
spamassassinAlpine:v3.19 |
before 3.4.3-r0 | 3.4.3-r0 |
Show 60 moreShow less
| Package | Affected | Fixed |
|---|---|---|
spamassassinAlpine:v3.20 |
before 3.4.3-r0 | 3.4.3-r0 |
spamassassinAlpine:v3.21 |
before 3.4.3-r0 | 3.4.3-r0 |
spamassassinAlpine:v3.22 |
before 3.4.3-r0 | 3.4.3-r0 |
spamassassinAlpine:v3.23 |
before 3.4.3-r0 | 3.4.3-r0 |
spamassassinAlpine:v3.24 |
before 3.4.3-r0 | 3.4.3-r0 |
spamassassinAlpine:v3.8 |
before 3.4.3-r0 | 3.4.3-r0 |
spamassassinAlpine:v3.9 |
before 3.4.3-r0 | 3.4.3-r0 |
spamassassinDebian:12 |
before 3.4.3~rc6-1 | 3.4.3~rc6-1 |
spamassassinDebian:13 |
before 3.4.3~rc6-1 | 3.4.3~rc6-1 |
spamassassinDebian:14 |
before 3.4.3~rc6-1 | 3.4.3~rc6-1 |
spamassassinDebian:8 From an advisory covering 2 CVEs |
before 3.4.2-0+deb8u2, plus listed versions 3.4.0-63.4.1-13.4.1-23.4.1-33.4.1-3~bpo8+1 Show 8 moreShow less3.4.1-43.4.1-53.4.1-5.13.4.1-63.4.1-6~bpo8+13.4.1-73.4.1-83.4.2-0+deb8u1 |
3.4.2-0+deb8u2 |
spamassassinDebian:9 From an advisory covering 2 CVEs |
before 3.4.2-1~deb9u2, plus listed versions 3.4.1-63.4.1-6+deb9u13.4.1-73.4.1-83.4.2-1~deb9u1 |
3.4.2-1~deb9u2 |
spamassassinDebian:10 From an advisory covering 2 CVEs |
before 3.4.2-1+deb10u1, plus listed versions 3.4.2-1 |
3.4.2-1+deb10u1 |
spamassassinMageia:7 From an advisory covering 2 CVEs |
before 3.4.3-1.mga7 | 3.4.3-1.mga7 |
spamassassin-rulesMageia:7 From an advisory covering 2 CVEs |
before 3.4.3-1.mga7 | 3.4.3-1.mga7 |
spamassassinRed Hat:enterprise_linux:7::client |
before 0:3.4.0-6.el7 | 0:3.4.0-6.el7 |
spamassassin-debuginfoRed Hat:enterprise_linux:7::client |
before 0:3.4.0-6.el7 | 0:3.4.0-6.el7 |
spamassassinRed Hat:enterprise_linux:7::server |
before 0:3.4.0-6.el7 | 0:3.4.0-6.el7 |
spamassassin-debuginfoRed Hat:enterprise_linux:7::server |
before 0:3.4.0-6.el7 | 0:3.4.0-6.el7 |
spamassassinRed Hat:enterprise_linux:7::workstation |
before 0:3.4.0-6.el7 | 0:3.4.0-6.el7 |
spamassassin-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:3.4.0-6.el7 | 0:3.4.0-6.el7 |
spamassassinRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:3.4.2-10.el8 | 0:3.4.2-10.el8 |
spamassassin-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:3.4.2-10.el8 | 0:3.4.2-10.el8 |
spamassassin-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 4 CVEs |
before 0:3.4.2-10.el8 | 0:3.4.2-10.el8 |
spamassassinSUSE:HPE Helion OpenStack 8 From an advisory covering 2 CVEs |
before 3.4.5-44.13.1 | 3.4.5-44.13.1 |
spamassassinSUSE:OpenStack Cloud 8 From an advisory covering 2 CVEs |
before 3.4.5-44.13.1 | 3.4.5-44.13.1 |
spamassassinSUSE:OpenStack Cloud 9 From an advisory covering 2 CVEs |
before 3.4.5-44.13.1 | 3.4.5-44.13.1 |
spamassassinSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 2 CVEs |
before 3.4.5-44.13.1 | 3.4.5-44.13.1 |
spamassassinSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 2 CVEs |
before 3.4.5-44.13.1 | 3.4.5-44.13.1 |
spamassassinSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 2 CVEs |
before 3.4.5-44.13.1 | 3.4.5-44.13.1 |
spamassassinSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 2 CVEs |
before 3.4.5-44.13.1 | 3.4.5-44.13.1 |
spamassassinSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 2 CVEs |
before 3.4.5-44.13.1 | 3.4.5-44.13.1 |
spamassassinSUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 2 CVEs |
before 3.4.5-44.13.1 | 3.4.5-44.13.1 |
spamassassinSUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 2 CVEs |
before 3.4.5-44.13.1 | 3.4.5-44.13.1 |
spamassassinSUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 2 CVEs |
before 3.4.5-44.13.1 | 3.4.5-44.13.1 |
spamassassinSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 2 CVEs |
before 3.4.5-44.13.1 | 3.4.5-44.13.1 |
spamassassinSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 2 CVEs |
before 3.4.5-44.13.1 | 3.4.5-44.13.1 |
spamassassinSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 2 CVEs |
before 3.4.5-7.14.1 | 3.4.5-7.14.1 |
spamassassinSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 2 CVEs |
before 3.4.5-7.14.1 | 3.4.5-7.14.1 |
spamassassinSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 2 CVEs |
before 3.4.5-7.14.1 | 3.4.5-7.14.1 |
spamassassinSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 2 CVEs |
before 3.4.5-7.14.1 | 3.4.5-7.14.1 |
spamassassinSUSE:Linux Enterprise Module for Basesystem 15 SP2 From an advisory covering 2 CVEs |
before 3.4.5-12.10.1 | 3.4.5-12.10.1 |
spamassassinSUSE:Linux Enterprise Module for Development Tools 15 SP2 From an advisory covering 2 CVEs |
before 3.4.5-12.10.1 | 3.4.5-12.10.1 |
spamassassinSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS From an advisory covering 2 CVEs |
before 3.4.5-12.10.1 | 3.4.5-12.10.1 |
spamassassinSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 2 CVEs |
before 3.4.5-12.10.1 | 3.4.5-12.10.1 |
spamassassinSUSE:Linux Enterprise Server 15 SP1-BCL From an advisory covering 2 CVEs |
before 3.4.5-12.10.1 | 3.4.5-12.10.1 |
spamassassinSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 2 CVEs |
before 3.4.5-12.10.1 | 3.4.5-12.10.1 |
spamassassinSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 2 CVEs |
before 3.4.5-12.10.1 | 3.4.5-12.10.1 |
spamassassinSUSE:Manager Proxy 4.0 From an advisory covering 2 CVEs |
before 3.4.5-12.10.1 | 3.4.5-12.10.1 |
spamassassinSUSE:Manager Retail Branch Server 4.0 From an advisory covering 2 CVEs |
before 3.4.5-12.10.1 | 3.4.5-12.10.1 |
spamassassinSUSE:Manager Server 4.0 From an advisory covering 2 CVEs |
before 3.4.5-12.10.1 | 3.4.5-12.10.1 |
spamassassinSUSE:Enterprise Storage 6 From an advisory covering 2 CVEs |
before 3.4.5-12.10.1 | 3.4.5-12.10.1 |
spamassassinUbuntu:Pro:14.04:LTS |
before 3.4.2-0ubuntu0.14.04.1+esm1, plus listed versions 3.3.2-6ubuntu23.3.2-8ubuntu13.3.2-8ubuntu23.4.0-13.4.0-1ubuntu13.4.0-1ubuntu23.4.0-1ubuntu2.13.4.2-0ubuntu0.14.04.1 |
3.4.2-0ubuntu0.14.04.1+esm1 |
spamassassinUbuntu:16.04:LTS |
before 3.4.2-0ubuntu0.16.04.2, plus listed versions 3.4.1-13.4.1-23.4.1-33.4.2-0ubuntu0.16.04.1 |
3.4.2-0ubuntu0.16.04.2 |
spamassassinUbuntu:18.04:LTS |
before 3.4.2-0ubuntu0.18.04.2, plus listed versions 3.4.1-73.4.1-83.4.1-8build13.4.2-0ubuntu0.18.04.1 |
3.4.2-0ubuntu0.18.04.2 |
spamassassinUbuntu:16.04:LTS From an advisory covering 2 CVEs |
before 3.4.2-0ubuntu0.16.04.2, plus listed versions 3.4.1-13.4.1-23.4.1-33.4.2-0ubuntu0.16.04.1 |
3.4.2-0ubuntu0.16.04.2 |
spamassassinUbuntu:18.04:LTS From an advisory covering 2 CVEs |
before 3.4.2-0ubuntu0.18.04.2, plus listed versions 3.4.1-73.4.1-83.4.1-8build13.4.2-0ubuntu0.18.04.1 |
3.4.2-0ubuntu0.18.04.2 |
spamassassinUbuntu:Pro:14.04:LTS From an advisory covering 2 CVEs |
before 3.4.2-0ubuntu0.14.04.1+esm1, plus listed versions 3.3.2-6ubuntu23.3.2-8ubuntu13.3.2-8ubuntu23.4.0-13.4.0-1ubuntu13.4.0-1ubuntu23.4.0-1ubuntu2.13.4.2-0ubuntu0.14.04.1 |
3.4.2-0ubuntu0.14.04.1+esm1 |
spamassassinopenSUSE:Leap 15.2 From an advisory covering 2 CVEs |
before 3.4.5-lp152.10.3.1 | 3.4.5-lp152.10.3.1 |
spamassassinopenSUSE:Tumbleweed From an advisory covering 9 CVEs |
before 3.4.6-71.3 | 3.4.6-71.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-12420 is a high vulnerability (CVSS 7.5) in Apache Spamassassin, published December 12, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.23%, the 94th percentile. Fixed in spamassassin 3.4.3-r0.
References
lists.apache.org/thread.html/64cf76749956dd08f7d5b86ec9f3321f382cfd7fe717ccd1be940c92%40%3Cannounce.spamassassin.apache.org%3E
openwall.com/lists/oss-security/2019/12/12/2
svn.apache.org/repos/asf/spamassassin/branches/3.4/build/announcements/3.4.3.txt
Show 63 moreShow less
bz.apache.org/SpamAssassin/show_bug.cgi?id=7747
debian.org/security/2019/dsa-4584
seclists.org/bugtraq/2019/Dec/27
lists.debian.org/debian-lts-announce/2019/12/msg00019.html
usn.ubuntu.com/4237-1
nvd.nist.gov/vuln/detail/CVE-2019-12420
github.com/advisories/GHSA-q6ww-c56f-5fhw
security.alpinelinux.org/vuln/CVE-2019-12420
security-tracker.debian.org/tracker/CVE-2019-12420
advisories.mageia.org/MGASA-2019-0406.html
bugs.mageia.org/show_bug.cgi?id=25860
access.redhat.com/errata/RHSA-2020:3973
bugzilla.redhat.com/show_bug.cgi?id=1784984
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3973.json
cve.org/CVERecord?id=CVE-2019-12420
suse.com/support/update/announcement/2021/suse-su-20211152-1
bugzilla.suse.com/1159133
ubuntu.com/security/CVE-2019-12420
markmail.org/message/pyp425yrulfxyhrn
lists.opensuse.org/archives/list/[email protected]/thread/GXHYC7MWI2M6Y32ROZZBS5HOZOAF2HAN