PT-2021-23523 · Unknown+8 · Gnu Mailman+8

Andre Protas + 2 · Published 2021-10-21 · Updated 2022-05-31 · CVE-2021-42096

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GNU Mailman versions prior to 2.1.35

Description The issue allows remote Privilege Escalation. A certain csrf token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password.

Recommendations For GNU Mailman versions prior to 2.1.35, update to version 2.1.35 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin interface to minimize the risk of exploitation.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

ALSA-2021:4826

ALT-PU-2021-3235

ALT-PU-2021-3277

ALT-PU-2021-3299

CESA-2021_4826

CVE-2021-42096

DLA-2791-1

DSA-4991-1

OESA-2021-1405

OPENSUSE-SU-2021:1436-1

OPENSUSE-SU-2021:1452-1

OPENSUSE-SU-2021_1436-1

RHSA-2021:4826

RHSA-2021:4837

RHSA-2021:4838

RHSA-2021:4839

RHSA-2021_4826

RLSA-2021:4826

SUSE-SU-2022:1886-1

SUSE-SU-2022_1886-1

USN-5121-1

USN-5121-2

Affected Products

Alt Linux

Almalinux

Centos

Gnu Mailman

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

References · 58

• https://ubuntu.com/security/CVE-2021-42096 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5121-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12137 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2791-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-42096 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-12108 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-42097 · Security Note
• http://openwall.com/lists/oss-security/2021/10/21/4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15011 · Security Note
• https://ubuntu.com/security/CVE-2021-42097 · Vendor Advisory
• https://bugs.launchpad.net/mailman/+bug/1947639 · Patch
• https://osv.dev/vulnerability/USN-5121-2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5121-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1452-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42096 · Security Note