CVE-2019-12420

Public on 2019-12-12

Modified on 2020-10-22

Description

In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly.

Severity

Medium

See what this means

CVSS v3 Base Score

7.5

Affected Packages

Platform	Package	Release Date	Advisory
Amazon Linux 1	spamassassin	2020-02-04	ALAS-2020-1341
Amazon Linux 2 - Core	spamassassin	2020-10-27	ALAS2-2020-1545

CVSS Scores

	Score Type	Score	Vector
Amazon Linux	CVSSv3	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	CVSSv2	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P
NVD	CVSSv3	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2019-12420 Mitre: CVE-2019-12420