Every CVE Search/ Get API key

CVE-2020-1931

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted...

8.1 HighFix available

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

6.46%Down 3.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.1

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.

Record
CVE-2020-1931
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-78
Updated
2026-11-02
CVE List No score

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.

Record
CVE-2020-1931
Updated
2026-11-02
EUVDEUVD-2020-12747 No score

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.

Record
EUVD-2020-12747
Updated
2026-11-03
GitHub AdvisoriesGHSA-p22p-qh9c-7725 No score

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted...

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.

Record
GHSA-p22p-qh9c-7725
Updated
2026-11-02
OSVALPINE-CVE-2020-1931 8.1

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.

Record
ALPINE-CVE-2020-1931
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 8.1

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.

Record
CVE-2020-1931
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 13 moreShow less
OSVDEBIAN-CVE-2020-1931 8.1

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.

Record
DEBIAN-CVE-2020-1931
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:4625 7.5

Red Hat Security Advisory: spamassassin security update

Record
RHSA-2020:4625
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-1931 8.1

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.

Record
UBUNTU-CVE-2020-1931
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2025-1758728428 No score

spamassassin: Fix of 2 CVEs

  • CVE-2020-1930: fix command-execution vulnerability in SpamAssassin .cf parsing
  • CVE-2020-1931: fix command-execution vulnerability in SpamAssassin .cf parsing
Record
CLSA-2025-1758728428
Updated
2026-11-02
OSVCLSA-2025-1758796775 No score

spamassassin: Fix of 2 CVEs

  • CVE-2020-1930: fix command-execution vulnerability in SpamAssassin .cf parsing
  • CVE-2020-1931: fix command-execution vulnerability in SpamAssassin .cf parsing
Record
CLSA-2025-1758796775
Updated
2026-11-02
OSVMGASA-2020-0079 No score

Updated spamassassin packages fix security vulnerabilities

The updated packages fix security vulnerabilities:

Nefarious rule configuration (.cf) files can be configured to run system commands with sa-compile. (CVE-2020-1930)

Nefarious rule configuration (.cf) files can be configured to run system commands with warnings. (CVE-2020-1931)

Record
MGASA-2020-0079
Updated
2026-11-02
OSVopenSUSE-SU-2020:0446-1 No score

Security update for spamassassin

This update for spamassassin fixes the following issues:

Security issues fixed:

  • CVE-2018-11805: Fixed an issue with delimiter handling in rule files related to is_regexp_valid() (bsc#1118987).
  • CVE-2020-1930: Fixed an issue with rule configuration (.cf) files which can be configured to run system commands (bsc#1162197).
  • CVE-2020-1931: Fixed an issue with rule configuration (.cf) files which can be configured to run system commands with warnings (bsc#1162200).

Non-security issue fixed:

  • Altering hash requires restarting loop (bsc#862963).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

Record
openSUSE-SU-2020:0446-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11395-1 No score

perl-Mail-SpamAssassin-3.4.6-71.3 on GA media

These are all security issues fixed in the perl-Mail-SpamAssassin-3.4.6-71.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11395-1
Updated
2026-11-02
OSVSUSE-SU-2020:0810-1 No score

Security update for spamassassin

This update for spamassassin fixes the following issues:

  • CVE-2018-11805: Fixed an issue with delimiter handling in rule files related to is_regexp_valid() (bsc#1118987).
  • CVE-2020-1930: Fixed an issue with rule configuration (.cf) files which can be configured to run system commands (bsc#1162197).
  • CVE-2020-1931: Fixed an issue with rule configuration (.cf) files which can be configured to run system commands with warnings (bsc#1162200).
Record
SUSE-SU-2020:0810-1
Updated
2026-11-02
OSVSUSE-SU-2020:0811-1 No score

Security update for spamassassin

This update for spamassassin fixes the following issues:

Security issues fixed:

  • CVE-2018-11805: Fixed an issue with delimiter handling in rule files related to is_regexp_valid() (bsc#1118987).
  • CVE-2020-1930: Fixed an issue with rule configuration (.cf) files which can be configured to run system commands (bsc#1162197).
  • CVE-2020-1931: Fixed an issue with rule configuration (.cf) files which can be configured to run system commands with warnings (bsc#1162200).

Non-security issue fixed:

  • Altering hash requires restarting loop (bsc#862963).
Record
SUSE-SU-2020:0811-1
Updated
2026-11-02
OSVSUSE-SU-2020:0813-1 No score

Security update for spamassassin

This update for spamassassin fixes the following issues:

Security issues fixed:

  • CVE-2018-11805: Fixed an issue with delimiter handling in rule files related to is_regexp_valid() (bsc#1118987).
  • CVE-2020-1930: Fixed an issue with rule configuration (.cf) files which can be configured to run system commands (bsc#1162197).
  • CVE-2020-1931: Fixed an issue with rule configuration (.cf) files which can be configured to run system commands with warnings (bsc#1162200).

Non-security issue fixed:

  • Altering hash requires restarting loop (bsc#862963).
Record
SUSE-SU-2020:0813-1
Updated
2026-11-02
OSVUSN-4265-1 No score

spamassassin vulnerabilities

It was discovered that SpamAssassin incorrectly handled certain CF files. If a user or automated system were tricked into using a specially-crafted CF file, a remote attacker could possibly run arbitrary code.

Record
USN-4265-1
Updated
2026-11-02
OSVUSN-4265-2 No score

spamassassin vulnerabilities

USN-4265-1 fixed several vulnerabilities in SpamAssassin. This update provides the corresponding update for Ubuntu 12.04 ESM and 14.04 ESM.

Original advisory details:

It was discovered that SpamAssassin incorrectly handled certain CF files. If a user or automated system were tricked into using a specially-crafted CF file, a remote attacker could possibly run arbitrary code.

Record
USN-4265-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
spamassassin
Alpine:v3.10
 before 3.4.4-r0
3.4.4-r0
spamassassin
Alpine:v3.11
 before 3.4.4-r0
3.4.4-r0
spamassassin
Alpine:v3.12
 before 3.4.4-r0
3.4.4-r0
spamassassin
Alpine:v3.13
 before 3.4.4-r0
3.4.4-r0
spamassassin
Alpine:v3.14
 before 3.4.4-r0
3.4.4-r0
spamassassin
Alpine:v3.15
 before 3.4.4-r0
3.4.4-r0
spamassassin
Alpine:v3.16
 before 3.4.4-r0
3.4.4-r0
spamassassin
Alpine:v3.17
 before 3.4.4-r0
3.4.4-r0
spamassassin
Alpine:v3.18
 before 3.4.4-r0
3.4.4-r0
spamassassin
Alpine:v3.19
 before 3.4.4-r0
3.4.4-r0
Show 49 moreShow less
Affected packages
PackageAffectedFixed
spamassassin
Alpine:v3.20
 before 3.4.4-r0
3.4.4-r0
spamassassin
Alpine:v3.21
 before 3.4.4-r0
3.4.4-r0
spamassassin
Alpine:v3.22
 before 3.4.4-r0
3.4.4-r0
spamassassin
Alpine:v3.23
 before 3.4.4-r0
3.4.4-r0
spamassassin
Alpine:v3.24
 before 3.4.4-r0
3.4.4-r0
spamassassin
TuxCare:OracleLinux:6
From an advisory covering 2 CVEs
 before 3.3.1-3.el6.tuxcare.els1
3.3.1-3.el6.tuxcare.els1
spamassassin
TuxCare:CentOS:6
From an advisory covering 2 CVEs
 before 3.3.1-3.el6.tuxcare.els1
3.3.1-3.el6.tuxcare.els1
spamassassin
Debian:12
 before 3.4.4~rc1-1
3.4.4~rc1-1
spamassassin
Debian:13
 before 3.4.4~rc1-1
3.4.4~rc1-1
spamassassin
Debian:14
 before 3.4.4~rc1-1
3.4.4~rc1-1
spamassassin
Debian:8
From an advisory covering 2 CVEs
 before 3.4.2-0+deb8u3, plus listed versions
3.4.0-63.4.1-13.4.1-23.4.1-33.4.1-3~bpo8+1
Show 9 moreShow less
3.4.1-43.4.1-53.4.1-5.13.4.1-63.4.1-6~bpo8+13.4.1-73.4.1-83.4.2-0+deb8u13.4.2-0+deb8u2
3.4.2-0+deb8u3
spamassassin
Debian:9
From an advisory covering 2 CVEs
 before 3.4.2-1~deb9u3, plus listed versions
3.4.1-63.4.1-6+deb9u13.4.1-73.4.1-83.4.2-1~deb9u13.4.2-1~deb9u2
3.4.2-1~deb9u3
spamassassin
Debian:10
From an advisory covering 2 CVEs
 before 3.4.2-1+deb10u2, plus listed versions
3.4.2-13.4.2-1+deb10u1
3.4.2-1+deb10u2
spamassassin
Mageia:7
From an advisory covering 2 CVEs
 before 3.4.4-1.mga7
3.4.4-1.mga7
spamassassin-rules
Mageia:7
From an advisory covering 2 CVEs
 before 3.4.4-1.mga7
3.4.4-1.mga7
spamassassin
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:3.4.2-10.el8
0:3.4.2-10.el8
spamassassin-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:3.4.2-10.el8
0:3.4.2-10.el8
spamassassin-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:3.4.2-10.el8
0:3.4.2-10.el8
spamassassin
SUSE:HPE Helion OpenStack 8
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:OpenStack Cloud 7
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:OpenStack Cloud 8
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server 12 SP1-LTSS
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Enterprise Storage 5
From an advisory covering 3 CVEs
 before 3.4.2-44.8.1
3.4.2-44.8.1
spamassassin
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 3 CVEs
 before 3.4.2-12.5.1
3.4.2-12.5.1
spamassassin
SUSE:Linux Enterprise Module for Development Tools 15 SP1
From an advisory covering 3 CVEs
 before 3.4.2-12.5.1
3.4.2-12.5.1
spamassassin
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 3 CVEs
 before 3.4.2-7.9.1
3.4.2-7.9.1
spamassassin
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 3 CVEs
 before 3.4.2-7.9.1
3.4.2-7.9.1
spamassassin
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 3 CVEs
 before 3.4.2-7.9.1
3.4.2-7.9.1
spamassassin
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 3 CVEs
 before 3.4.2-7.9.1
3.4.2-7.9.1
spamassassin
Ubuntu:Pro:14.04:LTS
 before 3.4.2-0ubuntu0.14.04.1+esm2, plus listed versions
3.3.2-6ubuntu23.3.2-8ubuntu13.3.2-8ubuntu23.4.0-13.4.0-1ubuntu1
Show 4 moreShow less
3.4.0-1ubuntu23.4.0-1ubuntu2.13.4.2-0ubuntu0.14.04.13.4.2-0ubuntu0.14.04.1+esm1
3.4.2-0ubuntu0.14.04.1+esm2
spamassassin
Ubuntu:16.04:LTS
 before 3.4.2-0ubuntu0.16.04.3, plus listed versions
3.4.1-13.4.1-23.4.1-33.4.2-0ubuntu0.16.04.13.4.2-0ubuntu0.16.04.2
3.4.2-0ubuntu0.16.04.3
spamassassin
Ubuntu:18.04:LTS
 before 3.4.2-0ubuntu0.18.04.3, plus listed versions
3.4.1-73.4.1-83.4.1-8build13.4.2-0ubuntu0.18.04.13.4.2-0ubuntu0.18.04.2
3.4.2-0ubuntu0.18.04.3
spamassassin
Ubuntu:16.04:LTS
From an advisory covering 2 CVEs
 before 3.4.2-0ubuntu0.16.04.3, plus listed versions
3.4.1-13.4.1-23.4.1-33.4.2-0ubuntu0.16.04.13.4.2-0ubuntu0.16.04.2
3.4.2-0ubuntu0.16.04.3
spamassassin
Ubuntu:18.04:LTS
From an advisory covering 2 CVEs
 before 3.4.2-0ubuntu0.18.04.3, plus listed versions
3.4.1-73.4.1-83.4.1-8build13.4.2-0ubuntu0.18.04.13.4.2-0ubuntu0.18.04.2
3.4.2-0ubuntu0.18.04.3
spamassassin
Ubuntu:Pro:14.04:LTS
From an advisory covering 2 CVEs
 before 3.4.2-0ubuntu0.14.04.1+esm2, plus listed versions
3.3.2-6ubuntu23.3.2-8ubuntu13.3.2-8ubuntu23.4.0-13.4.0-1ubuntu1
Show 4 moreShow less
3.4.0-1ubuntu23.4.0-1ubuntu2.13.4.2-0ubuntu0.14.04.13.4.2-0ubuntu0.14.04.1+esm1
3.4.2-0ubuntu0.14.04.1+esm2
spamassassin
openSUSE:Leap 15.1
From an advisory covering 3 CVEs
 before 3.4.2-lp151.8.3.1
3.4.2-lp151.8.3.1
spamassassin
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 3.4.6-71.3
3.4.6-71.3

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-1931 is a high vulnerability (CVSS 8.1) in Apache Spamassassin, published January 30, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.46%, the 93rd percentile. Fixed in spamassassin 3.4.4-r0.

References

Show 56 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open