Debian Security Advisory

DSA-4818-1 sympa -- security update

Date Reported:

23 Dec 2020

Affected Packages:

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 952428, Bug 961491, Bug 971904, Bug 976020.
In Mitre's CVE dictionary: CVE-2020-9369, CVE-2020-10936, CVE-2020-26932, CVE-2020-29668.

More information:

Several vulnerabilities were discovered in Sympa, a mailing list manager, which could result in local privilege escalation, denial of service or unauthorized access via the SOAP API.

Additionally to mitigate CVE-2020-26880 the sympa_newaliases-wrapper is no longer installed setuid root by default. A new Debconf question is introduced to allow setuid installations in setups where it is needed.

For the stable distribution (buster), these problems have been fixed in version 6.2.40~dfsg-1+deb10u1.

We recommend that you upgrade your sympa packages.

For the detailed security status of sympa please refer to its security tracker page at: https://security-tracker.debian.org/tracker/sympa