GitHub Advisoryadvisory · PyPI

GHSA-2jg5-xgvv-4wq7 Mailman Core vulnerable to timing attacks

HIGH Published 2023-04-15 Modified 2024-09-30 Official page ↗
Aliases
CVE-2021-34337
Ecosystem
PyPI
Packages
mailman
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-208
Reviewed
2023-04-18

Affected packages

• PyPI mailman: < 3.3.5 → fixed in 3.3.5

Description

An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.

Related

Alias · CVE (1)

  • CVE-2021-34337 An issue was discovered in Mailman Core before 3.3.5. vulnerability

Weakness · CWE (1)

  • CWE-208 Observable Timing Discrepancy weakness

References