PT-2021-23524 · Unknown+8 · Gnu Mailman+8

Andre Protas + 2 · Published 2021-10-21 · Updated 2024-05-11 · CVE-2021-42097

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GNU Mailman versions prior to 2.1.35

Description The issue allows remote Privilege Escalation. A csrf token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin, potentially leading to account takeover.

Recommendations For versions prior to 2.1.35, update to version 2.1.35 or later to resolve the issue. As a temporary workaround, consider restricting access to admin accounts or implementing additional CSRF protection measures until a patch is applied.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

ALSA-2021:4826

ALT-PU-2021-3235

ALT-PU-2021-3277

ALT-PU-2021-3299

ALT-PU-2021-3532

ALT-PU-2024-7639

CESA-2021_4826

CESA-2021_4913

CVE-2021-42097

DLA-2791-1

DSA-4991-1

OESA-2021-1405

OPENSUSE-SU-2021:1436-1

OPENSUSE-SU-2021:1452-1

OPENSUSE-SU-2021_1436-1

RHSA-2021:4826

RHSA-2021:4837

RHSA-2021:4838

RHSA-2021:4839

RHSA-2021:4913

RHSA-2021_4826

RHSA-2021_4913

RLSA-2021:4826

USN-5121-1

USN-5121-2

Affected Products

Alt Linux

Almalinux

Centos

Gnu Mailman

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

References · 50

• https://ubuntu.com/security/CVE-2021-42096 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5121-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12137 · Vendor Advisory
• https://bugs.launchpad.net/mailman/+bug/1947640 · Patch
• https://osv.dev/vulnerability/DLA-2791-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12108 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-42097 · Security Note
• http://openwall.com/lists/oss-security/2021/10/21/4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15011 · Security Note
• https://ubuntu.com/security/CVE-2021-42097 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5121-2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5121-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1452-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42096 · Security Note
• https://linux.oracle.com/errata/ELSA-2021-4826.html · Vendor Advisory