Every CVE Search/ Get API key

CVE-2021-34337

Mailman Core vulnerable to timing attacks

6.3 MediumFix available

CVE-2021-34337 is a medium vulnerability (CVSS 6.3) in Gnu Mailman, published October 21, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. Fixed in mailman 3.3.5.

An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.30%Up 0.3 points since Apr 16, 2023
90%50%10%1%

What each source reports

NVD Score used 6.3

An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.

Record
CVE-2021-34337
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-208
Updated
2026-11-02
CVE List 6.3

An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.

Record
CVE-2021-34337
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-208
Updated
2026-11-02
EUVDEUVD-2023-0129 6.3

An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.

Record
EUVD-2023-0129
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-2jg5-xgvv-4wq7 7.6

Mailman Core vulnerable to timing attacks

An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.

Record
GHSA-2jg5-xgvv-4wq7
CVSS 4.0
7.6 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-208
Updated
2026-11-02
OSV 6.3

An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.

Record
CVE-2021-34337
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2021-34337 6.3

An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.

Record
DEBIAN-CVE-2021-34337
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-2jg5-xgvv-4wq7 7.6

Mailman Core vulnerable to timing attacks

An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.

Record
GHSA-2jg5-xgvv-4wq7
CVSS 4.0
7.6 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-208
Updated
2026-11-02
OSVOESA-2022-2005 7.4

mailman security update

This is GNU Mailman, a mailing list management system distributed under the terms of the GNU General Public License (GPL) version 3 or later. The name of this software is spelled 'Mailman' with a leading capital 'M' but with a lower case second `m'. Any other spelling is incorrect. Security Fix(es):

Check the REST API password in a way that is resistant to timing attacks. Using basic string equality is vulnerable to timing attacks as it will short circuit at the first wrong character. Using hmac.compare_digest avoids that issue and will take the same time, regardless of whether the value is correct or not. This is only exploitable if an attacker can talk directly to the REST API, which by default is bound to localhost.

Reference:

https://bugs.gentoo.org/828115(CVE-2021-34337)

Record
OESA-2022-2005
CVSS 3.1
7.4 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-34337 6.3

An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.

Record
UBUNTU-CVE-2021-34337
CVSS 3.1
6.3 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2024:11644-1 No score

python3-mailman-3.3.5-1.1 on GA media

These are all security issues fixed in the python3-mailman-3.3.5-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11644-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11760-1 No score

mailman3-3.3.5-2.1 on GA media

These are all security issues fixed in the mailman3-3.3.5-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11760-1
Updated
2026-11-02
OSVPYSEC-2023-22 No score

An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.

Record
PYSEC-2023-22
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mailman
PyPI
 before 3.3.5
3.3.5
mailman3
Debian:12
 before 3.3.7-1
3.3.7-1
mailman3
Debian:13
 before 3.3.7-1
3.3.7-1
mailman3
Debian:14
 before 3.3.7-1
3.3.7-1
mailman
PyPI
 before 3.3.5, plus listed versions
3.0.03.0.0a13.0.0a23.0.0a33.0.0a4
Show 38 moreShow less
3.0.0a53.0.0a63.0.0a73.0.0a83.0.0b13.0.0b23.0.0b33.0.0b3-3.0.0b43.0.0b53.0.13.0.23.0.33.0rc13.1.03.1.0b13.1.0b23.1.0b33.1.0b43.1.0b53.1.0rc13.1.0rc23.1.13.2.03.2.13.2.1rc13.2.23.3.03.3.13.3.1rc13.3.23.3.2rc13.3.2rc23.3.33.3.3rc13.3.43.3.5b13.3.5rc1
3.3.5
mailman
openEuler:22.03-LTS
 before 3.3.2-5.oe2203
3.3.2-5.oe2203
mailman
PyPI
 before 3.3.5, plus listed versions
3.0.03.0.0a13.0.0a23.0.0a33.0.0a4
Show 45 moreShow less
3.0.0a53.0.0a63.0.0a73.0.0a83.0.0b13.0.0b23.0.0b33.0.0b3-3.0.0b43.0.0b53.0.13.0.23.0.33.0rc13.1.03.1.0b13.1.0b23.1.0b33.1.0b43.1.0b53.1.0rc13.1.0rc23.1.13.2.03.2.13.2.1rc13.2.23.3.03.3.13.3.1rc13.3.23.3.2rc13.3.2rc23.3.33.3.3rc13.3.43.3.5b13.3.5rc13.1.0.b43.03.0b5-A3.0b53.0b43.0b33.0b2
3.3.5
mailman3
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.1.1-73.1.1-83.1.1-9
 None known
mailman3
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.2.1-13.2.2-1
 None known
python3-mailman
openSUSE:Tumbleweed
 before 3.3.5-1.1
3.3.5-1.1
mailman3
openSUSE:Tumbleweed
 before 3.3.5-2.1
3.3.5-2.1

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 6 moreShow less
This page doesn't list everything

Left out here: 9 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open