← Vulnerability feed

Vulnerability record · CVE-2020-1931 · published 30 January 2020

CVE-2020-1931: Apache spamassassin os command injection vulnerability

Apache · Spamassassin

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.

8.1 CVSS 3.1 High EPSS 6.5% · top 6.5% CWE-78 · OS command injection
8.1CVSS 3.1 base score, v2 9.3
6.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
18References
17 Jun 2026Last modified by NVD

Description

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00003.html
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7784 Permissions Required
https://lists.debian.org/debian-lts-announce/2020/02/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B7SY2LUSH2X3IUXN4EQQ5A6
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOVVKFP2G2AF5GHAB4WMHOE
https://seclists.org/bugtraq/2020/Feb/1
https://usn.ubuntu.com/4265-1/
https://usn.ubuntu.com/4265-2/
https://www.debian.org/security/2020/dsa-4615
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00003.html
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7784 Permissions Required
https://lists.debian.org/debian-lts-announce/2020/02/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B7SY2LUSH2X3IUXN4EQQ5A6
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOVVKFP2G2AF5GHAB4WMHOE
https://seclists.org/bugtraq/2020/Feb/1
https://usn.ubuntu.com/4265-1/
https://usn.ubuntu.com/4265-2/
https://www.debian.org/security/2020/dsa-4615

Track CVE-2020-1931 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-1946Apache spamassassin os command injection vulnerabilityIn Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. …EPSS 6.1%9.8CVE-2018-11780Apache spamassassin code injection vulnerabilityA potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.EPSS 11%8.1CVE-2020-1930Apache spamassassin os command injection vulnerabilityA command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configur…EPSS 7.1%7.8CVE-2018-11781Apache spamassassin code injection vulnerabilityApache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.EPSS 0.98%7.8CVE-2016-1238Debian linux permissions and access controls vulnerability(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/…EPSS 0.78%7.5CVE-2019-12420Apache spamassassin uncontrolled resource consumption vulnerabilityIn Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the r…EPSS 7.2%6.7CVE-2018-11805Apache spamassassin os command injection vulnerabilityIn Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits ca…EPSS 0.87%5.3CVE-2017-15705Apache spamassassin improper input validation vulnerabilityA denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags…EPSS 7.9%

Source: NIST National Vulnerability Database (record CVE-2020-1931), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.