Debian alert DLA-2441-1 (sympa)

From:
             
 
Sylvain Beucler <beuc@beuc.net>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 2441-1] sympa security update
Date:
             
 
Mon, 09 Nov 2020 14:04:02 +0100
Message-ID:
             
 
<20201109130402.nerfp5ailnmprnsd@mail.beuc.net>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2441-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                                     
November 09, 2020                             https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : sympa
Version        : 6.2.16~dfsg-3+deb9u4
CVE ID         : CVE-2018-1000671 CVE-2020-26880
Debian Bug     : 908165 972189

A privilege escalation was discovered in Sympa, a modern mailing list
manager. It is fixed when Sympa is used in conjunction with common
MTAs (such as Exim or Postfix) by disabling a setuid executable,
although no fix is currently available for all environments (such as
sendmail).  Additionally, an open-redirect vulnerability was
discovered and fixed.

CVE-2020-26880

    Sympa allows a local privilege escalation from the sympa user
    account to full root access by modifying the sympa.conf
    configuration file (which is owned by sympa) and parsing it
    through the setuid sympa_newaliases-wrapper executable.

CVE-2018-1000671

    Sympa contains a CWE-601: URL Redirection to Untrusted Site ('Open
    Redirect') vulnerability in The "referer" parameter of the
    wwsympa.fcgi login action. that can result in Open redirection and
    reflected XSS via data URIs.

For Debian 9 stretch, these problems have been fixed in version
6.2.16~dfsg-3+deb9u4.

We recommend that you upgrade your sympa packages.

For the detailed security status of sympa please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/sympa

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEEQic8GuN/xDR88HkSj/HLbo2JBZ8FAl+pPNEACgkQj/HLbo2J
BZ/iXggAjfE4h4T5RJ4s4DaKtErkb6kPqqSTgxrcMVGbS1o0t9sdwFCnhQxu3Ipq
g+xLWx+yQ1XpJjDbgGRal9CrnCwYpKq6Ps4fUfUOW3Ets4lGOiv/gmlbbIyq3V6A
ZOu90SSgqf1ltOk6x+9yfvyr3p2bO+vsyEN+JEBbsm6Cpl3GaqHrcqgHIVhblrLX
ZOlXkV+Kur22IidxD7Bv4zFzF3bORL66HSs03Gy6I2lGmIRQr+TvgvIUEMsyus2i
mh6HlS/y8jC5IRm3T3M2t749bzetdcSMl9qWpTw90fMwmwfhVTlN5PJ7AyVwkEJT
MEVxagVbEnc24oUlttI/wib1/feGFA==
=ssTg
-----END PGP SIGNATURE-----