CVE-2020-9369
published 2020-02-24CVE-2020-9369: Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of notifications to…
PriorityP336high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.92%
85.6th percentile
Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of notifications to listmasters) via a series of requests with malformed parameters.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | sympa | < sympa 6.2.40~dfsg-4 (bookworm) | sympa 6.2.40~dfsg-4 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| sympa | sympa | >= 0 < 6.2.40~dfsg-4 | 6.2.40~dfsg-4 |
| sympa | sympa | >= 0 < 6.2.40~dfsg-4 | 6.2.40~dfsg-4 |
| sympa | sympa | >= 0 < 6.2.40~dfsg-4 | 6.2.40~dfsg-4 |
| sympa | sympa | >= 0 < 6.2.40~dfsg-4 | 6.2.40~dfsg-4 |
| sympa | sympa | 6.2.38 – 6.2.52 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9cxv-8fwp-3hgq: Sympa 6
ghsa_unreviewed·2022-05-24
CVE-2020-9369 [MEDIUM] CWE-400 GHSA-9cxv-8fwp-3hgq: Sympa 6
Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of notifications to listmasters) via a series of requests with malformed parameters.
OSV
CVE-2020-9369: Sympa 6
osv·2020-02-24·CVSS 7.5
CVE-2020-9369 [HIGH] CVE-2020-9369: Sympa 6
Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of notifications to listmasters) via a series of requests with malformed parameters.
Debian
CVE-2020-9369: sympa - Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service...
vendor_debian·2020·CVSS 7.5
CVE-2020-9369 [HIGH] CVE-2020-9369: sympa - Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service...
Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of notifications to listmasters) via a series of requests with malformed parameters.
Scope: local
bookworm: resolved (fixed in 6.2.40~dfsg-4)
bullseye: resolved (fixed in 6.2.40~dfsg-4)
forky: resolved (fixed in 6.2.40~dfsg-4)
sid: resolved (fixed in 6.2.40~dfsg-4)
trixie: resolved (fixed in 6.2.40~dfsg-4)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-9369 sympa: malformed requests lead to cause denial of service [fedora-all]
bugzilla·2020-05-04·CVSS 7.5
CVE-2020-9369 [HIGH] CVE-2020-9369 sympa: malformed requests lead to cause denial of service [fedora-all]
CVE-2020-9369 sympa: malformed requests lead to cause denial of service [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported v
Bugzilla
CVE-2020-9369 sympa: malformed requests lead to cause denial of service
bugzilla·2020-05-04·CVSS 7.5
CVE-2020-9369 [HIGH] CVE-2020-9369 sympa: malformed requests lead to cause denial of service
CVE-2020-9369 sympa: malformed requests lead to cause denial of service
Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of notifications to listmasters) via a series of requests with malformed parameters.
References:
https://github.com/sympa-community/sympa/issues/886
https://lists.fedoraproject.org/archives/list/[email protected]/message/6TMVZ5LVYCCIHGEC7RQUMGUE7DJWUXN7/
https://lists.fedoraproject.org/archives/list/[email protected]/message/A3FUYYLV6URRLAJVWXNJYK2CNOKKNHXC/
https://lists.fedoraproject.org/archives/list/[email protected]/message/XO4WJYNNHWM7DUKCN4EWYYYPXZSOI7BQ/
https://sympa-community.github.io/security/2020-001.html
Bugzilla
CVE-2020-9369 sympa: malformed requests lead to cause denial of service [epel-all]
bugzilla·2020-05-04·CVSS 7.5
CVE-2020-9369 [HIGH] CVE-2020-9369 sympa: malformed requests lead to cause denial of service [epel-all]
CVE-2020-9369 sympa: malformed requests lead to cause denial of service [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versi
https://github.com/sympa-community/sympa/issues/886https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6TMVZ5LVYCCIHGEC7RQUMGUE7DJWUXN7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A3FUYYLV6URRLAJVWXNJYK2CNOKKNHXC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO4WJYNNHWM7DUKCN4EWYYYPXZSOI7BQ/https://sympa-community.github.io/security/2020-001.htmlhttps://www.debian.org/security/2020/dsa-4818https://github.com/sympa-community/sympa/issues/886https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6TMVZ5LVYCCIHGEC7RQUMGUE7DJWUXN7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A3FUYYLV6URRLAJVWXNJYK2CNOKKNHXC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO4WJYNNHWM7DUKCN4EWYYYPXZSOI7BQ/https://sympa-community.github.io/security/2020-001.htmlhttps://www.debian.org/security/2020/dsa-4818
2020-02-24
Published