PatchTheCVECVE-2020-1930: A command execution issue was found in Apache SpamAssassin prior to 3.4.3
CVE-2020-1930 is a high-severity flaw (CVSS 8.1) affecting spamassassin. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. With this bug unpatched, exploits can be injected in a number of scenarios including the same privileges as spamd is run which may be elevated though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that user
Why this priority
- High severity
- EPSS top 6%: very likely to be exploited
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.1 (High) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 7.1% (top 6%) |
| CISA exploited list | No |
| Weakness | CWE-78 |
| Published | 2020-01-30 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-1930?
spamassassin: upgrade to 3.4.3. Exact commands for each OS are on this page.
Is CVE-2020-1930 being exploited?
CVE-2020-1930 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-1930 affect?
CVE-2020-1930 affects spamassassin. Severity is high (CVSS 8.1). A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. With this bug unpatched, exploits can
How urgent is CVE-2020-1930?
Priority 62/100. High severity; EPSS top 6%: very likely to be exploited; Remotely exploitable, no login, no user action; On your watchlist
Related CVEs
- CVE-2020-1946 CRITICAL 9.8 UPGRADE MITIGATE In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system
- CVE-2020-1931 HIGH 8.1 UPGRADE A command execution issue was found in Apache SpamAssassin prior to 3.4.3
- CVE-2019-12420 HIGH 7.5 UPGRADE MITIGATE In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources
- CVE-2018-11805 MEDIUM 6.7 UPGRADE MITIGATE In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any o
- CVE-2018-11781 HIGH 7.8 UPGRADE MITIGATE Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.