Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Mailman - CVE-2021-43332

Vulnerability identifier: #VU58350

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-43332

CWE-ID: CWE-338

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a brute-force attack.

The vulnerability exists due to the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. A remote user with moderator privileges can perform a brute-force attack against the token and obtain administrator's password.

Mailman
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Ubuntu
openEuler
mailman
mailman-debuginfo
mailman-debugsource
mailman (Ubuntu package)

Install update from vendor's website.

Mailman - update to 2.1.36
mailman - update to 2.1.17-3.26.1
mailman-debuginfo - update to 2.1.17-3.26.1
mailman-debugsource - update to 2.1.17-3.26.1
mailman (Ubuntu package) - addressed in versions 1:2.1.26-1ubuntu0.5, 1:2.1.29-1ubuntu3.1
mailman - addressed in versions 2.1.36-1, 2.1.36-2
mailman-debuginfo - addressed in versions 2.1.36-1, 2.1.36-2
mailman-debugsource - addressed in versions 2.1.36-1, 2.1.36-2

• https://bugs.launchpad.net/mailman/+bug/1949403
• https://mail.python.org/archives/list/mailman-announce@python.org/message/I2X7PSFXIEPLM3UMKZMGOEO3UFYETGRL/

• Multiple vulnerabilities in GNU Mailman
• Ubuntu update for mailman
• SUSE update for mailman
• openEuler update for mailman
• openEuler 20.03 LTS SP3 update for mailman