CVE-2019-19920

HIGH 8.8CVE-2019-19920 · Published 22/12/2019 · updated 17/06/2026

In short

CVE-2019-19920 is a HIGH (CVSS 8.8) vulnerability affecting sa-exim (sa-exim project).
Chance of exploitation in the next 30 days (EPSS): 3.2%, higher than 88.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
sa-exim sa-exim_project	`= 4.2.1`	No fix yet

Description

sa-exim 4.2.1 allows attackers to execute arbitrary code if they can write a .cf file or a rule. This occurs because Greylisting.pm relies on eval (rather than direct parsing and/or use of the taint feature). This issue is similar to CVE-2018-11805.

References

bugs.debian.org/946829 · Mailing List
lists.debian.org/debian-lts-announce/2020/01/msg00006.html · Mailing List
marc.info · Mailing List
marc.info · Mailing List
usn.ubuntu.com/4520-1 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free