Resource exhaustion in Sympa - CVE-2020-9369
Published: February 24, 2020 / Updated: December 28, 2020
Vulnerability identifier: #VU49166
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-9369
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can send a series of requests with malformed parameters and consume all available disk space by creating temporary files.
Affected software
Sympa
Fedora
sympa (Debian package)
sympa
Fedora
sympa (Debian package)
sympa
How to mitigate CVE-2020-9369
Install updates from vendor's website.
Sympa - update to 6.2.54
sympa (Debian package) - update to 6.2.40~dfsg-1+deb10u1
sympa - addressed in versions 6.2.54-1.el6, 6.2.54-1.el7, 6.2.54-1.fc30, 6.2.54-1.fc31, 6.2.54-1.fc32
sympa (Debian package) - update to 6.2.40~dfsg-1+deb10u1
sympa - addressed in versions 6.2.54-1.el6, 6.2.54-1.el7, 6.2.54-1.fc30, 6.2.54-1.fc31, 6.2.54-1.fc32
External References
- https://github.com/sympa-community/sympa/issues/886
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6TMVZ5LVYCCIHGEC7RQUMGUE7DJWUXN7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A3FUYYLV6URRLAJVWXNJYK2CNOKKNHXC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XO4WJYNNHWM7DUKCN4EWYYYPXZSOI7BQ/
- https://sympa-community.github.io/security/2020-001.html
- https://www.debian.org/security/2020/dsa-4818