CVE-2020-9369

NameCVE-2020-9369
DescriptionSympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of notifications to listmasters) via a series of requests with malformed parameters.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-4818-1
Debian Bugs952428

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
sympa (PTS)jessie, jessie (lts)6.1.23~dfsg-2+deb8u3fixed
stretch (security), stretch (lts), stretch6.2.16~dfsg-3+deb9u5fixed
buster (security), buster, buster (lts)6.2.40~dfsg-1+deb10u1fixed
bullseye6.2.60~dfsg-4fixed
bookworm6.2.70~dfsg-2fixed
sid, trixie6.2.72~dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
sympasourcejessie(not affected)
sympasourcestretch(not affected)
sympasourcebuster6.2.40~dfsg-1+deb10u1DSA-4818-1
sympasource(unstable)6.2.40~dfsg-4low952428

Notes

[stretch] - sympa <not-affected> (Vulnerability introduced later in 6.2.38)
[jessie] - sympa <not-affected> (Vulnerability introduced later in 6.2.38)
https://github.com/sympa-community/sympa/issues/886
https://sympa-community.github.io/security/2020-001.html
Upstream patch: https://github.com/sympa-community/sympa/releases/download/6.2.54/sympa-6.2.52-sa-2020-001.patch

Search for package or bug name: Reporting problems