CVE-2019-19920: OS Command Injection
Last updated 11 February 2026
Other sources
sa-exim 4.2.1 allows attackers to execute arbitrary code if they can write a .cf file or a rule. This occurs because Greylisting.pm relies on eval (rather than direct parsing and/or use of the taint feature). This issue is similar to CVE-2018-11805.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/sa-eximto a version that resolves this vulnerability.Fixed in 4.2.1-20Fixed in 4.2.1-22 - Upgrade
Upgrade
ubuntu/sa-eximto a version that resolves this vulnerability.Fixed in 4.2.1-14+deb8u1build0.16.04.1 - Upgrade
Upgrade
ubuntu/sa-eximto a version that resolves this vulnerability.Fixed in 4.2.1-16ubuntu0.1~esm1
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19920?
CVE-2019-19920 is considered a critical vulnerability that allows attackers to execute arbitrary code on the affected systems.
How do I fix CVE-2019-19920?
To fix CVE-2019-19920, upgrade sa-exim to version 4.2.1-20 or later.
Which versions of sa-exim are affected by CVE-2019-19920?
CVE-2019-19920 affects sa-exim version 4.2.1.
Can CVE-2019-19920 be exploited remotely?
Yes, CVE-2019-19920 can be exploited remotely if an attacker can write a .cf file or a rule on the server.
What are the implications of CVE-2019-19920 for my system?
The implications of CVE-2019-19920 include potential unauthorized code execution, leading to a complete compromise of the affected system.