PT-2021-4287 · Unknown+3 · Hyperkitty+3

Amir Sarabadani + 1 · Published 2021-05-26 · Updated 2022-06-05 · CVE-2021-33038

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions HyperKitty versions prior to 1.3.5

Description The issue is related to an error when importing archives of private mailing lists, which become publicly accessible during the import process. This could allow a remote attacker to access confidential data. For example, sensitive information might be available on the web for an hour during a large migration from Mailman 2 to Mailman 3.

Recommendations For HyperKitty versions prior to 1.3.5, update to version 1.3.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the management/commands/hyperkitty import.py module until a patch is available. Avoid using the hyperkitty import command with private mailing list archives until the issue is resolved.

Exploit

Fix

Information Disclosure

Incorrect Default Permissions

Weakness Enumeration

CWE-200

CWE-276

Related Identifiers

BDU:2021-04895

CVE-2021-33038

DSA-4922-1

GHSA-H39G-Q63V-4H9P

OPENSUSE-SU-2021:0861-1

OPENSUSE-SU-2021_0861-1

OPENSUSE-SU-2024:11207-1

PYSEC-2021-77

Affected Products

Hyperkitty

Mailman 2

Mailman 3

Suse

References · 26

• 🔥 https://gitlab.com/mailman/hyperkitty/-/issues/380 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2021-33038 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h39g-q63v-4h9p · Vendor Advisory
• https://techblog.wikimedia.org/2021/06/11/discovering-and-fixing-cve-2021-33038-in-mailman3 · Patch
• https://osv.dev/vulnerability/PYSEC-2021-77 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33038 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-33038 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4922-1 · Vendor Advisory
• https://debian.org/security/2021/dsa-4922 · Vendor Advisory
• https://gitlab.com/mailman/hyperkitty/-/commit/9025324597d60b2dff740e49b70b15589d6804fa · Patch
• https://ubuntu.com/security/CVE-2021-33038 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0861-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-33038 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-33038 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33038 · Vendor Advisory