An issue was discovered in management/commands/hyperkitty_import.py in HyperKitty through 1.3.4. When importing a private mailing list's archives, these archives are publicly visible for the duration of the import. For example, sensitive information might be available on the web for an hour during a large migration from Mailman 2 to Mailman 3.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in management/commands/hyperkitty_import.py in HyperKitty through 1.3.4. When     importing a private mailing list's archives, these archives are publicly visible for the duration of the     import. For example, sensitive information might be available on the web for an hour during a large     migration from Mailman 2 to Mailman 3. (CVE-2021-33038)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for python-HyperKitty fixes the following issues :

  - CVE-2021-33038 [boo#1186575], information disclosure     when importing a private mailing list

Amir Sarabadani and Kunal Mehta discovered that the import functionality of Hyperkitty, the web user interface to access Mailman 3 archives, did not restrict the visibility of private archives during the import, i.e. that during the import of a private Mailman 2 archive the archive was publicly accessible until the import completed.

ID	Name	Product	Family	Severity
257113	Linux Distros Unpatched Vulnerability : CVE-2021-33038	Nessus	Misc.	high
150461	openSUSE Security Update : python-HyperKitty (openSUSE-2021-861)	Nessus	SuSE Local Security Checks	high
150109	Debian DSA-4922-1 : hyperkitty - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2021-33038

high

Tenable Plugins

high

high

high