Critical severity9.8NVD Advisory· Published Mar 25, 2021· Updated Jun 17, 2026

CVE-2020-1946

Description

In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Apache/Spamassassin3 versions
cpe:2.3:a:apache:spamassassin:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:apache:spamassassin:*:*:*:*:*:*:*:*range: <3.4.5
- (no CPE)range: <3.4.5
- (no CPE)range: Apache SpamAssassin
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Fedoraproject/Fedora3 versions
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
osv-coords31 versions
pkg:rpm/almalinux/spamassassin pkg:rpm/opensuse/spamassassin&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/spamassassin&distro=openSUSE%20Tumbleweed pkg:rpm/suse/spamassassin&distro=HPE%20Helion%20OpenStack%208 pkg:rpm/suse/spamassassin&distro=SUSE%20Enterprise%20Storage%206 pkg:rpm/suse/spamassassin&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOS pkg:rpm/suse/spamassassin&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS pkg:rpm/suse/spamassassin&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOS pkg:rpm/suse/spamassassin&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSS pkg:rpm/suse/spamassassin&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP2 pkg:rpm/suse/spamassassin&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP2 pkg:rpm/suse/spamassassin&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/spamassassin&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCL pkg:rpm/suse/spamassassin&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSS pkg:rpm/suse/spamassassin&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSS pkg:rpm/suse/spamassassin&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5 pkg:rpm/suse/spamassassin&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCL pkg:rpm/suse/spamassassin&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS pkg:rpm/suse/spamassassin&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSS pkg:rpm/suse/spamassassin&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/spamassassin&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/spamassassin&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5 pkg:rpm/suse/spamassassin&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015 pkg:rpm/suse/spamassassin&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1 pkg:rpm/suse/spamassassin&distro=SUSE%20Manager%20Proxy%204.0 pkg:rpm/suse/spamassassin&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.0 pkg:rpm/suse/spamassassin&distro=SUSE%20Manager%20Server%204.0 pkg:rpm/suse/spamassassin&distro=SUSE%20OpenStack%20Cloud%208 pkg:rpm/suse/spamassassin&distro=SUSE%20OpenStack%20Cloud%209 pkg:rpm/suse/spamassassin&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208 pkg:rpm/suse/spamassassin&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209
< 3.4.4-4.el8+ 30 more
- (no CPE)range: < 3.4.4-4.el8
- (no CPE)range: < 3.4.5-lp152.10.3.1
- (no CPE)range: < 3.4.6-71.3
- (no CPE)range: < 3.4.5-44.13.1
- (no CPE)range: < 3.4.5-12.10.1
- (no CPE)range: < 3.4.5-12.10.1
- (no CPE)range: < 3.4.5-12.10.1
- (no CPE)range: < 3.4.5-7.14.1
- (no CPE)range: < 3.4.5-7.14.1
- (no CPE)range: < 3.4.5-12.10.1
- (no CPE)range: < 3.4.5-12.10.1
- (no CPE)range: < 3.4.5-44.13.1
- (no CPE)range: < 3.4.5-44.13.1
- (no CPE)range: < 3.4.5-44.13.1
- (no CPE)range: < 3.4.5-44.13.1
- (no CPE)range: < 3.4.5-44.13.1
- (no CPE)range: < 3.4.5-12.10.1
- (no CPE)range: < 3.4.5-12.10.1
- (no CPE)range: < 3.4.5-7.14.1
- (no CPE)range: < 3.4.5-44.13.1
- (no CPE)range: < 3.4.5-44.13.1
- (no CPE)range: < 3.4.5-44.13.1
- (no CPE)range: < 3.4.5-7.14.1
- (no CPE)range: < 3.4.5-12.10.1
- (no CPE)range: < 3.4.5-12.10.1
- (no CPE)range: < 3.4.5-12.10.1
- (no CPE)range: < 3.4.5-12.10.1
- (no CPE)range: < 3.4.5-44.13.1
- (no CPE)range: < 3.4.5-44.13.1
- (no CPE)range: < 3.4.5-44.13.1
- (no CPE)range: < 3.4.5-44.13.1

Patches

Vulnerability mechanics

References

lists.debian.org/debian-lts-announce/2021/04/msg00000.htmlnvdMailing ListThird Party Advisory
s.apache.org/3r1whnvdMailing ListVendor Advisory
security.gentoo.org/glsa/202105-26nvdThird Party Advisory
www.debian.org/security/2021/dsa-4879nvdThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7V2SBVTKVLFFT36ECJQ7TQ7KAQCQZDRZ/nvd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JFBFRIG5TX23NF4ND6OAKKY7I6TLRCCP/nvd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKAXYBKBMQOLIW6UKASJCAZRBOIYS4RL/nvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.005
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000