Description
An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mailman3 | 3.3.7-1 | — |
| Debian 13 | mailman3 | 3.3.7-1 | — |
| Debian 12 | mailman3 | 3.3.7-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | mailman3 | No fix yet | — |
| Ubuntu 18.04 LTS | mailman3 | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | mailman3 | 3.3.5-2.1 | openSUSE-SU-2024:11760-1 |
| openSUSE Tumbleweed | python3-mailman | 3.3.5-1.1 | openSUSE-SU-2024:11644-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | mailman | < 3.3.5 | 3.3.5 | GHSA-2jg5-xgvv-4wq7 |
Advisories 2
- openSUSE-SU-2024:11644-1 python3-mailman-3.3.5-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11760-1 mailman3-3.3.5-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026