CVE-2020-29668

Name	CVE-2020-29668
Description	Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DLA-2499-1, DSA-4818-1
Debian Bugs	976020

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
sympa (PTS)	buster, buster (security)	6.2.40~dfsg-1+deb10u1	fixed
	bullseye	6.2.60~dfsg-4	fixed
	bookworm, sid	6.2.70~dfsg-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
sympa	source	stretch	6.2.16~dfsg-3+deb9u5	DLA-2499-1
sympa	source	buster	6.2.40~dfsg-1+deb10u1	DSA-4818-1
sympa	source	(unstable)	6.2.58~dfsg-2		976020

https://github.com/sympa-community/sympa/issues/1041
https://github.com/sympa-community/sympa/pull/1044