Security readout for executives and security teams
Plain-English summary
This flaw can let a remote sender crash ClamAV scanning by submitting a specially crafted email file, but only where the optional DLP feature is enabled. The business impact is availability loss in mail or file-scanning workflows, not data theft or system takeover based on the provided sources.
Executive priority
Treat as a prompt patching item for affected mail-scanning and security-processing systems. It can interrupt malware scanning and message flow, but the provided evidence points to denial of service only, not compromise of confidentiality or integrity.
Technical view
CVE-2020-3123 is a CWE-125 out-of-bounds read in the ClamAV DLP module affecting ClamAV 0.102.0 and 0.102.1 per the description. It is network-reachable, unauthenticated, low complexity, and rated CVSS 7.5 because successful exploitation can crash the scanning process.
Likely exposure
Exposure is most likely in organizations running ClamAV 0.102.0 or 0.102.1 with optional DLP enabled, especially on email scanning gateways or services that process inbound email files. Systems without DLP enabled are not described as affected in the source bundle.
Exploitation context
The provided sources describe remote unauthenticated denial of service through a crafted email file. The CVE is not listed as KEV in the bundle, and no cited source here confirms active exploitation in the wild.
Researcher notes
Key exposure hinges on optional DLP enablement. The source bundle has strong vendor and distribution references, but exploit telemetry is limited here. Validate version and configuration before assigning broad impact across all ClamAV installations.
Mitigation direction
- Upgrade ClamAV to a fixed vendor-supported release, including 0.102.2 or later where applicable.
- Apply distribution security updates from Ubuntu, Gentoo, or your operating system vendor.
- Prioritize mail gateways and high-volume scanning infrastructure using optional DLP.
- Review vendor guidance before changing DLP configuration as a temporary risk reduction.
- Monitor scanner crashes and failed mail-processing queues until patched.
Validation and detection
- Inventory ClamAV versions across servers, containers, appliances, and mail gateways.
- Confirm whether optional DLP is enabled on each ClamAV deployment.
- Verify patched packages or binaries are installed after remediation.
- Check service logs for recent ClamAV scanning process crashes.
- Confirm mail or file scanning resumes normally after updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-3123 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs59062CVE reference · vendor-advisory, x_refsource_CISCO
- https://blog.clamav.net/2020/02/clamav-01022-security-patch-released.htmlCVE reference · x_refsource_CONFIRM
- USN-4280-1CVE reference · vendor-advisory, x_refsource_UBUNTU
- USN-4280-2CVE reference · vendor-advisory, x_refsource_UBUNTU
- GLSA-202003-46CVE reference · vendor-advisory, x_refsource_GENTOO
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.