TI-2021-13379 Aliases CVE-2021-34337 GHSA-2jg5-xgvv-4wq7

An issue was discovered in Mailman Core before 3.3.5.

LOW 30CWE-208Published 2023-04-15 · Updated 2025-02-06

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-208.

Summary

An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00299 22nd percentileScored 2026-11-07

Fix Fixed mailman (PyPI): 3.3.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	mailman (PyPI)	before 3.3.5	3.3.5	Patch available	GHSA-2jg5-xgvv-4wq7

— Vendor— Affected all versions Fixed in — No fix listed CNA
mailman (PyPI) Vendor— Affected before 3.3.5 Fixed in 3.3.5 Patch available GHSA-2jg5-xgvv-4wq7

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:gnu:mailman::::::::	before 3.3.5	Vulnerable	GNU

cpe:2.3:a:gnu:mailman:*:*:*:*:*:*:*:* Versions before 3.3.5 Vulnerable ·GNU

Remediation

Fix · GHSA-2jg5-xgvv-4wq7 mailman (PyPI) Fixed in 3.3.5 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 3 products

Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8

Timeline

2026-10-02 Threatist record created from CVE-2021-34337
2026-10-03 Alias added: GHSA-2jg5-xgvv-4wq7

References

Patch 1

https://gitlab.com/mailman/mailman/-/commit/e4a39488c4510fcad8851217f10e7337a196bb51

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-34337

Other 4

TI-2025-28486 Path traversal in GNU Mailman CVSS 3.1HIGH 7.5
TI-2025-28487 OS command injection in GNU Mailman CVSS 3.1HIGH 8.1
TI-2025-28488 Incorrect authorization in GNU Mailman CVSS 3.1MEDIUM 5.3
TI-2015-02450 Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static… CVSS 2.0HIGH 7.6
TI-2002-00830 Cross-site scripting vulnerability in Mailman before 2.0.12 allows remote attackers to… CVSS 2.0HIGH 7.5
TI-2002-00374 Cross-site scripting vulnerabilities in Mailman before 2.0.11 allow remote attackers to… CVSS 2.0HIGH 7.5

See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences