Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-26880

Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying the sympa.conf configuration file (which is owned by sympa) and parsing it through the setuid sympa_newaliases-wrapper executable.

Published

2020-10-07T18:15:12.133

Last Modified

2024-11-21T05:20:24.210

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.8 (HIGH)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Access Vector: LOCAL
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

3.9

Impact Score

10.0

Weaknesses

Type: Primary
CWE-269

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	sympa	sympa	≤ 6.2.56	Yes
Application	sympa	sympa	6.2.57	Yes
Application	sympa	sympa	6.2.57	Yes
Operating System	fedoraproject	fedora	32	Yes
Operating System	fedoraproject	fedora	33	Yes
Operating System	fedoraproject	fedora	34	Yes
Operating System	debian	debian_linux	9.0	Yes

References

https://github.com/sympa-community/sympa/issues/1009 Third Party Advisory ([email protected])
https://github.com/sympa-community/sympa/issues/943#issuecomment-704779420 Third Party Advisory ([email protected])
https://github.com/sympa-community/sympa/issues/943#issuecomment-704842235 Third Party Advisory ([email protected])
https://lists.debian.org/debian-lts-announce/2020/11/msg00015.html Mailing List, Third Party Advisory ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5CUVLHGWCDA6B2NH467ZMKL6O2NGLQZN/ ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5MFWWYY4TSQAXBWZ6SBFX43BLUL3WWI/ ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2TKOL454ZKKLQCUSUPNEZ52WELN4OAH/ ([email protected])
https://github.com/sympa-community/sympa/issues/1009 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/sympa-community/sympa/issues/943#issuecomment-704779420 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/sympa-community/sympa/issues/943#issuecomment-704842235 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2020/11/msg00015.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5CUVLHGWCDA6B2NH467ZMKL6O2NGLQZN/ (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5MFWWYY4TSQAXBWZ6SBFX43BLUL3WWI/ (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2TKOL454ZKKLQCUSUPNEZ52WELN4OAH/ (af854a3a-2127-422b-91ae-364da2661108)