Bug 2027225 (CVE-2021-43332)

Summary:	CVE-2021-43332 mailman: a list moderator can crack the list admin password encrypted in a CSRF token
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	extras-orphan, infra-sig, jkaluza, mosvald, ngompa13
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mailman 2.1.36	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in mailman, where the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This flaw could potentially allow cracking of the password by a moderator utilizing an offline brute-force attack	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2027226, 2027227, 2028065
Bug Blocks:	2027228

Description Marian Rehak 2021-11-29 07:16:40 UTC

The CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.

External Reference:

https://bugs.launchpad.net/mailman/+bug/1949403

Comment 1 Marian Rehak 2021-11-29 07:17:55 UTC

Created mailman tracking bugs for this issue:

Affects: fedora-33 [bug 2027226]
Affects: fedora-34 [bug 2027227]