CVE-2019-19920

sa-exim 4.2.1 allows attackers to execute arbitrary code if they can write a .cf file or a rule

published December 22, 2019

CVSS
—
EPSS
3%
Percentile
88.2
In the wild
Unconfirmed
What it is

sa-exim 4.2.1 allows attackers to execute arbitrary code if they can write a .cf file or a rule. This occurs because Greylisting.pm relies on eval (rather than direct parsing and/or use of the taint feature). This issue is similar to CVE-2018-11805.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03247 · 88.2th percentile
Published
2019-12-22T17:07Z
EPSS history
Timeline
  • 22 DEC 17:07Z
    sa-exim 4.2.1 allows attackers to execute arbitrary code if they can write a .cf file or a rule
    cvelistv5