Medium severity6.3NVD Advisory· Published Apr 15, 2023· Updated Jun 17, 2026
CVE-2021-34337
CVE-2021-34337
Description
An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
mailmanPyPI | < 3.3.5 | 3.3.5 |
Affected products
5- ghsa-coords3 versionspkg:pypi/mailmanpkg:rpm/opensuse/mailman3&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/python3-mailman&distro=openSUSE%20Tumbleweed
< 3.3.5+ 2 more
- (no CPE)range: < 3.3.5
- (no CPE)range: < 3.3.5-2.1
- (no CPE)range: < 3.3.5-1.1
Patches
Vulnerability mechanics
References
6- gitlab.com/mailman/mailman/-/commit/e4a39488c4510fcad8851217f10e7337a196bb51nvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-2jg5-xgvv-4wq7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-34337ghsaADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/mailman/PYSEC-2023-22.yamlghsaWEB
- gitlab.com/mailman/mailman/-/issues/911nvdBroken LinkWEB
- gitlab.com/mailman/mailman/-/tagsnvdRelease NotesWEB
News mentions
0No linked articles in our index yet.