CVE-2021-34337

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2021-34337
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-34337.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-34337
Aliases
Related
Published
2023-04-15T20:16:00Z
Modified
2024-09-30T17:12:06.667665Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.

References

Affected packages

Debian:11 / mailman3

Package

Name
mailman3
Purl
pkg:deb/debian/mailman3?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.3.3-1
3.3.3-1.1
3.3.7-1
3.3.7-2
3.3.7-3
3.3.8-1
3.3.8-2~deb12u1
3.3.8-2~deb12u2
3.3.8-2
3.3.8-3
3.3.8-3.1~0exp0
3.3.8-3.1
3.3.8-3.2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / mailman3

Package

Name
mailman3
Purl
pkg:deb/debian/mailman3?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.3.7-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / gitlab.com/mailman/mailman

Affected ranges

Type
GIT
Repo
https://gitlab.com/mailman/mailman
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e4a39488c4510fcad8851217f10e7337a196bb51

Affected versions

3.*

3.0
3.0.0
3.0.0a7
3.0a1
3.0a2
3.0a3
3.0a4
3.0a5
3.0a6
3.0a7
3.0a8
3.0b1
3.0b2
3.0b3
3.0b4
3.0b5
3.0b5-A
3.0b5-B
3.0rc1
3.1.0
3.1.0.b4
3.1.0b1
3.1.0b2
3.1.0b3
3.1.0b4
3.1.0b5
3.1.0rc1
3.2.0
3.2.1
3.2.1rc1
3.2.2
3.3.0
3.3.1
3.3.1rc1
3.3.2
3.3.2rc2
3.3.3
3.3.4