OESA-2022-2005 (CVE-2021-34337)
Vulnerability from osv_openeuler – Published: 2022-10-21 11:05 – Updated: 2026-08-06 11:05 – Source websiteThis is GNU Mailman, a mailing list management system distributed under the terms of the GNU General Public License (GPL) version 3 or later. The name of this software is spelled 'Mailman' with a leading capital 'M' but with a lower case second `m'. Any other spelling is incorrect. Security Fix(es):
Check the REST API password in a way that is resistant to timing attacks. Using basic string equality is vulnerable to timing attacks as it will short circuit at the first wrong character. Using hmac.compare_digest avoids that issue and will take the same time, regardless of whether the value is correct or not. This is only exploitable if an attacker can talk directly to the REST API, which by default is bound to localhost.
Reference:
https://bugs.gentoo.org/828115(CVE-2021-34337)
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"noarch": [
"mailman-3.3.2-5.oe2203.noarch.rpm"
],
"src": [
"mailman-3.3.2-5.oe2203.src.rpm"
]
},
"package": {
"ecosystem": "openEuler:22.03-LTS",
"name": "mailman",
"purl": "pkg:rpm/openEuler/mailman\u0026distro=openEuler-22.03-LTS"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.2-5.oe2203"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "High"
},
"details": "This is GNU Mailman, a mailing list management system distributed under the terms of the GNU General Public License (GPL) version 3 or later. The name of this software is spelled \u0027Mailman\u0027 with a leading capital \u0027M\u0027 but with a lower case second `m\u0027. Any other spelling is incorrect. Security Fix(es):\r\n\r\nCheck the REST API password in a way that is resistant to timing attacks. Using basic string equality is vulnerable to timing attacks as it will short circuit at the first wrong character. Using hmac.compare_digest avoids that issue and will take the same time, regardless of whether the value is correct or not. This is only exploitable if an attacker can talk directly to the REST API, which by default is bound to localhost.\r\n\r\nReference:\r\n\r\nhttps://bugs.gentoo.org/828115(CVE-2021-34337)",
"id": "OESA-2022-2005",
"modified": "2026-08-06T11:05:19Z",
"published": "2022-10-21T11:05:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2005"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34337"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "mailman security update",
"upstream": [
"CVE-2021-34337"
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.