CVE-2020-26880: High severity sympa vulnerability
Published Oct 7, 2020
·Updated
Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying the sympa.conf configuration file (which is owned by sympa) and parsing it through the setuid sympanewaliases-wrapper executable.
Affected Software
8 affected components
debian/sympa<=6.2.60~dfsg-4, <=6.2.70~dfsg-2, <=6.2.72~dfsg-1
sympa sympa<=6.2.56
sympa sympa=6.2.57-beta1
sympa sympa=6.2.57-beta2
Fedoraproject Fedora=32
Fedoraproject Fedora=33
Fedoraproject Fedora=34
Debian Debian Linux=9.0
Event History
Oct 7, 2020
CVE Published
via MITRE·05:33 PM
Data Sourced
via MITRE·05:33 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-26880?
CVE-2020-26880 has a high severity level due to its potential for local privilege escalation to root access.
2
How do I fix CVE-2020-26880?
To fix CVE-2020-26880, update Sympa to version 6.2.60 or later.
3
Which versions of Sympa are affected by CVE-2020-26880?
CVE-2020-26880 affects Sympa versions up to 6.2.57b.2 and those specific versions listed in the advisory.
4
Can CVE-2020-26880 be exploited remotely?
No, CVE-2020-26880 requires local access to exploit the vulnerability.
5
What type of vulnerability is CVE-2020-26880?
CVE-2020-26880 is classified as a local privilege escalation vulnerability.