CVE-2021-34337
Summary
| CVE | CVE-2021-34337 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-04-15 20:16:00 UTC |
| Updated | 2023-04-25 18:17:00 UTC |
| Description | An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Not Found | MISC | gitlab.com | |
| Check the REST API password in a way that is resistant to timing attacks (CVE-2021-34337) (e4a39488) · Commits · GNU Mailman / Mailman Core · GitLab | MISC | gitlab.com | |
| Tags · GNU Mailman / Mailman Core · GitLab | MISC | gitlab.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 183284 Debian Security Update for mailman3 (CVE-2021-34337)