CVE-2021-34337

Name of the Vulnerable Software and Affected Versions Mailman Core versions prior to 3.3.5

Description An issue was discovered that allows an attacker with access to the REST API to use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.

Recommendations For Mailman Core versions prior to 3.3.5, update to version 3.3.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST API to minimize the risk of exploitation.