Debian Security Advisory
DSA-4818-1 sympa -- security update
- Date Reported:
- 23 Dec 2020
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 952428, Bug 961491, Bug 971904, Bug 976020.
In Mitre's CVE dictionary: CVE-2020-9369, CVE-2020-10936, CVE-2020-26932, CVE-2020-29668.
- More information:
Several vulnerabilities were discovered in Sympa, a mailing list manager, which could result in local privilege escalation, denial of service or unauthorized access via the SOAP API.
Additionally to mitigate CVE-2020-26880 the sympa_newaliases-wrapper is no longer installed setuid root by default. A new Debconf question is introduced to allow setuid installations in setups where it is needed.
For the stable distribution (buster), these problems have been fixed in version 6.2.40~dfsg-1+deb10u1.
We recommend that you upgrade your sympa packages.
For the detailed security status of sympa please refer to its security tracker page at: https://security-tracker.debian.org/tracker/sympa