PT-2023-12254 · Unknown+2 · Mailman Core+2

Legoktm · Published 2022-10-21 · Updated 2024-06-15 · CVE-2021-34337

Positive Technologies (AI Summary)

CVSS v4.0

7.6

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mailman Core versions prior to 3.3.5

Description An issue was discovered that allows an attacker with access to the REST API to use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.

Recommendations For Mailman Core versions prior to 3.3.5, update to version 3.3.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST API to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-208

Related Identifiers

ALT-PU-2023-5747

CVE-2021-34337

GHSA-2JG5-XGVV-4WQ7

OESA-2022-2005

OPENSUSE-SU-2024:11644-1

OPENSUSE-SU-2024:11760-1

PYSEC-2023-22

Affected Products

Alt Linux

Debian

Mailman Core

References · 21

• https://osv.dev/vulnerability/UBUNTU-CVE-2021-34337 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-34337 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-2005 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-34337 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2jg5-xgvv-4wq7 · Vendor Advisory
• https://gitlab.com/mailman/mailman/-/commit/e4a39488c4510fcad8851217f10e7337a196bb51 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-22 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11644-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-34337 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-34337 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34337 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34337 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11760-1 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/mailman/PYSEC-2023-22.yaml · Note
• https://t.me/cibsecurity/62241 · Telegram Post