CVE-2020-1930: 
Apache SpamAssassin vulnerability analysis and mitigation

A command execution vulnerability (CVE-2020-1930) was discovered in Apache SpamAssassin versions prior to 3.4.3. The vulnerability was disclosed on January 30, 2020, affecting the SpamAssassin spam filtering tool. The issue allows malicious rule configuration (.cf) files to execute system commands, similar to CVE-2018-11805 (NVD).

The vulnerability stems from improper handling of rule configuration (.cf) files that can be configured to run system commands. The issue has a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a network-exploitable vulnerability with high impact on confidentiality, integrity, and availability (NVD).

If exploited, the vulnerability could allow remote attackers to execute arbitrary system commands with the same privileges as the spamd process, which may be elevated. This could lead to system compromise, particularly if SpamAssassin is running with elevated privileges (Ubuntu Security).

Users should upgrade to SpamAssassin version 3.4.4 or later. If unable to upgrade, it is recommended to not use third-party rulesets, avoid using sa-compile, and not run spamd as an account with elevated privileges. Users should only use update channels or third-party .cf files from trusted sources (NVD).