Vulnerability · Published Apr 15, 2023 · Assigned by mitre
CVE-2021-34337
Medium 6.3
In plain English
A medium-severity security flaw in the mailman3 package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | mailman3 | 3.3.7-1 | DEBIAN-CVE-2021-34337 |
| Debian:13 | mailman3 | 3.3.7-1 | DEBIAN-CVE-2021-34337 |
| Debian:14 | mailman3 | 3.3.7-1 | DEBIAN-CVE-2021-34337 |
| PyPI | mailman | 3.3.5 | GHSA-2jg5-xgvv-4wq7 |
| PyPI | mailman | 3.3.5 | PYSEC-2023-22 |
Affected products (as reported)
Weakness: CWE-208 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N