sympa: CVE-2020-9369: Security flaws in CSRF prevention

Debian Bug report logs - #952428
sympa: CVE-2020-9369: Security flaws in CSRF prevention

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "Stefan Hornburg (Racke)" <racke@linuxia.de>

To: submit@bugs.debian.org

Subject: Security flaws in CSRF prevention

Date: Mon, 24 Feb 2020 10:43:39 +0100

[Message part 1 (text/plain, inline)]

package: sympa
severity: critical
version: 6.2.40~dfsg-3
tags: patch

A vulnerability has been discovered in Sympa web interface that can
cause denial of service (DoS) attack.

By submitting requests with malformed parameters, this flaw allows to
create junk files in Sympa's directory for temporary files.  And
particularly by tampering token to prevent CSRF, it allows to originate
excessive notification messages to listmasters.

Full advisory:

https://sympa-community.github.io/security/2020-001.html

Regards
           Racke

-- 
Ecommerce and Linux consulting + Perl and web application programming.
Debian and Sympa administration. Provisioning with Ansible.

[sympa-6.2.52-sa-2020-001.patch (text/x-patch, attachment)]

[signature.asc (application/pgp-signature, attachment)]

Send a report that this bug log contains spam.