Debian alert DLA-4668-1 (sympa)

From:
             
 
Utkarsh Gupta <utkarsh@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4668-1] sympa security update
Date:
             
 
Sat, 04 Jul 2026 19:32:16 +0530
Message-ID:
             
 
<CAPP0f94VSXXJmbM6bh+pENrJFt3mitHWLGPBYoJOETaW13UJng@mail.gmail.com>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -----------------------------------------------------------------------
Debian LTS Advisory DLA-4668-1              debian-lts@lists.debian.org
https://www.debian.org/lts/security/                      Utkarsh Gupta
July 04, 2026                               https://wiki.debian.org/LTS
- -----------------------------------------------------------------------

Package        : sympa
Version        : 6.2.70~dfsg-2+deb12u1
CVE ID         : CVE-2024-55919
Debian Bug     : 1090188

A flaw was found in Sympa’s web interface, a modern mailing list manager.
An attacker may bypass authentication by using an arbitrary e-mail
address when the generic SSO loging feature was enabled.

For Debian 12 bookworm, this problem has been fixed in version
6.2.70~dfsg-2+deb12u1.

We recommend that you upgrade your sympa packages.

For the detailed security status of sympa please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/sympa

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEbJ0QSEqa5Mw4X3xxgj6WdgbDS5YFAmpJEk0ACgkQgj6WdgbD
S5YuBQ//Qt+7xWOZEPqFrN2QQaGlwFkNTzOhq3h5jhFae5td/o3qUeuQbCOsDltI
6ewTYI2z/fkCwrbjwohphMDzLQh+DZws4wvVgpJRdBoUcrXvRAKdwCV30AQUJeDH
GgVQFEbm9SSLqqio3xKfDdhGCg+E8MAAIFWub4rTGDXeC+cKzBc2P/Hn8Xsy8aVC
+BvxierlhDg6YFBOpjWA5PI3uqLwclgmNbdZJDBd6MyYnVNihiRnD9G13G2DYuzh
NYA8x8aYt5OWplh+st6hVTu4ibQB83KVaKzBHVFkhxgiDSBOKWgW85KJfwC+K5wE
wJwgs+plL5FPxkY0saZozdXIDb0B8BOt+0BBATFOEWO3WTXvkK+2aY6Ri13WnfK4
sZUCd+XB0nmAKa/QBhNBWhrEmnJSlUEKHCUBaeduQxhtZAXypCxSZwT2Icr2bq6G
JnAVBP7V8PQpyRQUse18CU37cLDDJB0FkMNRa17sfoczYhFaTwheFgTS+sSnepaV
Nig4NLx6/K3ZjowhsM/9vT6FGYBD2ztkwaaGnh1kEy1srM8dKd2x7ujikkd0Shvg
r/oWQhAWEAqodL4ZG2IVW8TjB4RJ5wQvFmNig3II8i7+xMxRk1oBzRtmSkl8kew5
uKtwAmBfKnzrnXoA69AruO50o0N2JeRiA/5ZG006Lt9jBW+dxtM=
=45OI
-----END PGP SIGNATURE-----