CVE-2019-19920: OS Command Injection
Last updated 11 February 2026
Other sources
sa-exim 4.2.1 allows attackers to execute arbitrary code if they can write a .cf file or a rule. This occurs because Greylisting.pm relies on eval (rather than direct parsing and/or use of the taint feature). This issue is similar to CVE-2018-11805.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19920?
CVE-2019-19920 is considered a critical vulnerability that allows attackers to execute arbitrary code on the affected systems.
How do I fix CVE-2019-19920?
To fix CVE-2019-19920, upgrade sa-exim to version 4.2.1-20 or later.
Which versions of sa-exim are affected by CVE-2019-19920?
CVE-2019-19920 affects sa-exim version 4.2.1.
Can CVE-2019-19920 be exploited remotely?
Yes, CVE-2019-19920 can be exploited remotely if an attacker can write a .cf file or a rule on the server.
What are the implications of CVE-2019-19920 for my system?
The implications of CVE-2019-19920 include potential unauthorized code execution, leading to a complete compromise of the affected system.