CVE-2021-44227 Cross Site Request Forgery in mailman
An attacker can exploit a CSRF vulnerability in GNU Mailman to change admin passwords or modify settings by tricking a moderator into using a stolen token.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-44227?
CVE-2021-44227 is a high-severity vulnerability in Debian Debian Linux, published on 2 Dec 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.
Weakness: CWE-352
Which versions are affected by CVE-2021-44227?
3 open source packages ship an affected version, including mailman. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
mailman PyPI | All versions | 2.1.38 |
mailman PyPI | All versions | 2.1.38 |
mailman PyPI | All versions | 2.1.38 |
Linux distribution packages (16)
mailman AlmaLinux:8 | All versions | 3:2.1.29-12.module_el8.5.0+26+48d4c9ee.2 |
mailman AlmaLinux:8 | All versions | 3:2.1.29-12.module_el8.5.0+2602+327eb9f3.2 |
mailman Red Hat:enterprise_linux:8::appstream | All versions | 3:2.1.29-12.module+el8.5.0+13466+327eb9f3.2 |
mailman-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 3:2.1.29-12.module+el8.5.0+13466+327eb9f3.2 |
mailman-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 3:2.1.29-12.module+el8.5.0+13466+327eb9f3.2 |
mailman Red Hat:rhel_e4s:8.1::appstream | All versions | 3:2.1.29-5.module+el8.1.0+13542+e9b93c88 |
mailman-debuginfo Red Hat:rhel_e4s:8.1::appstream | All versions | 3:2.1.29-5.module+el8.1.0+13542+e9b93c88 |
mailman-debugsource Red Hat:rhel_e4s:8.1::appstream | All versions | 3:2.1.29-5.module+el8.1.0+13542+e9b93c88 |
mailman Red Hat:rhel_eus:8.2::appstream | All versions | 3:2.1.29-6.module+el8.2.0+13543+86b2c701 |
mailman-debuginfo Red Hat:rhel_eus:8.2::appstream | All versions | 3:2.1.29-6.module+el8.2.0+13543+86b2c701 |
mailman-debugsource Red Hat:rhel_eus:8.2::appstream | All versions | 3:2.1.29-6.module+el8.2.0+13543+86b2c701 |
mailman Red Hat:rhel_eus:8.4::appstream | All versions | 3:2.1.29-11.module+el8.4.0+13467+746daedf.2 |
mailman-debuginfo Red Hat:rhel_eus:8.4::appstream | All versions | 3:2.1.29-11.module+el8.4.0+13467+746daedf.2 |
mailman-debugsource Red Hat:rhel_eus:8.4::appstream | All versions | 3:2.1.29-11.module+el8.4.0+13467+746daedf.2 |
mailman Rocky Linux:8 | All versions | 3:2.1.29-12.module+el8.5.0+703+19300c10 |
mailman Rocky Linux:8 | All versions | 3:2.1.29-12.module+el8.5.0+717+27fd1ba7.2 |
Products include Debian Debian Linux, Gnu Mailman.
How do I fix CVE-2021-44227?
Upgrade mailman to 2.1.38 or later.
Is CVE-2021-44227 being exploited?
There is no known exploitation of CVE-2021-44227 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALSA-2021:4916, GHSA-xq58-69h2-765m, OESA-2021-1456, PYSEC-2026-660, RHSA-2021:4915, RHSA-2021:4916 and 5 more.