CVE-2020-9369

NameCVE-2020-9369
DescriptionSympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of notifications to listmasters) via a series of requests with malformed parameters.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs952428

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
sympa (PTS)stretch6.2.16~dfsg-3+deb9u2fixed
stretch (security)6.2.16~dfsg-3+deb9u3fixed
buster6.2.40~dfsg-1vulnerable
bullseye6.2.40~dfsg-7fixed
sid6.2.58~dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
sympasourcejessie(not affected)
sympasourcestretch(not affected)
sympasource(unstable)6.2.40~dfsg-4low952428

Notes

[buster] - sympa <no-dsa> (Minor issue)
[stretch] - sympa <not-affected> (Vulnerability introduced later in 6.2.38)
[jessie] - sympa <not-affected> (Vulnerability introduced later in 6.2.38)
https://github.com/sympa-community/sympa/issues/886
https://sympa-community.github.io/security/2020-001.html
Upstream patch: https://github.com/sympa-community/sympa/releases/download/6.2.54/sympa-6.2.52-sa-2020-001.patch

Search for package or bug name: Reporting problems