PatchTheCVECVE-2020-1931: A command execution issue was found in Apache SpamAssassin prior to 3.4.3
CVE-2020-1931 is a high-severity flaw (CVSS 8.1) affecting spamassassin. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remote
Why this priority
- High severity
- EPSS top 6%: very likely to be exploited
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.1 (High) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 6.5% (top 6%) |
| CISA exploited list | No |
| Weakness | CWE-78 |
| Published | 2020-01-30 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-1931?
spamassassin: upgrade to 3.4.3. Exact commands for each OS are on this page.
Is CVE-2020-1931 being exploited?
CVE-2020-1931 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-1931 affect?
CVE-2020-1931 affects spamassassin. Severity is high (CVSS 8.1). A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to
How urgent is CVE-2020-1931?
Priority 62/100. High severity; EPSS top 6%: very likely to be exploited; Remotely exploitable, no login, no user action; On your watchlist
Related CVEs
- CVE-2020-1946 CRITICAL 9.8 UPGRADE MITIGATE In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system
- CVE-2020-1930 HIGH 8.1 UPGRADE A command execution issue was found in Apache SpamAssassin prior to 3.4.3
- CVE-2019-12420 HIGH 7.5 UPGRADE MITIGATE In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources
- CVE-2018-11805 MEDIUM 6.7 UPGRADE MITIGATE In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any o
- CVE-2018-11781 HIGH 7.8 UPGRADE MITIGATE Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.