CVE-2021-34337

Name	CVE-2021-34337
Description	An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs	1004934

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mailman3 (PTS)	buster	3.2.1-1	vulnerable
	bullseye	3.3.3-1	vulnerable
	bookworm, sid	3.3.8-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mailman3	source	(unstable)	3.3.7-1			1004934

Notes

[bullseye] - mailman3 <no-dsa> (Minor issue)
[buster] - mailman3 <no-dsa> (Minor issue; will be fixed via point release)
Fixed by: https://gitlab.com/mailman/mailman/-/commit/e4a39488c4510fcad8851217f10e7337a196bb51 (3.3.5b1)