# SA-Exim vulnerability allows arbitrary code execution via SpamAssassin rules

> **Key takeaway:** A flaw in SA-Exim's greylisting rule evaluation allows attackers with write access to SpamAssassin configurations to execute arbitrary code.

**Published:** 2026-11-12T20:54:57+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/sa-exim-vulnerability-allows-arbitrary-code-execution-via-sp.html 

## Summary
A security vulnerability has been identified in SA-Exim, a package used to integrate SpamAssassin with the Exim v4 Mail Transfer Agent (MTA). The defect involves the unsafe evaluation of parameters within the greylisting SpamAssassin rule.

An attacker who possesses the ability to write or modify SpamAssassin configuration files or rules can exploit this flaw to execute arbitrary code on the system. This issue specifically affects users running Ubuntu 18.04 LTS who utilize the sa-exim package.

## Technical details of CVE-2019-19920
- **Vulnerability Type:** Arbitrary code execution via unsafe parameter evaluation.
- **Attack Vector:** Local/Configuration-based; requires the ability to write to SpamAssassin configuration files or rules.
- **Affected Component:** The greylisting rule implementation within the sa-exim package.
- **Mitigation:** Users on Ubuntu 18.04 LTS must update to sa-exim version 4.2.1-16ubuntu0.1~esm1 via Ubuntu Pro/ESM Apps.

## Why it matters
This vulnerability highlights the risks associated with complex integrations between mail transfer agents and external filtering engines. Because the fix is provided through Ubuntu Pro's ESM Apps, administrators on legacy 18.04 systems must have an active Ubuntu Pro subscription to receive the security patch.