CVE-2019-12420

7.5HIGH

Key Information:

Vendor
Apache
Status
Apache Spamassassin
Vendor
CVE Published:
12 December 2019

Summary

In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly.

Affected Version(s)

Apache SpamAssassin Apache SpamAssassin prior to 3.4.3

References

https://lists.apache.org/thread.html/64cf76749956dd08f7d5...
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/e3c2367351286b77a74a...
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/5ef362d6da12126fafc8...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.