CVE-2020-26880
First published: Wed Oct 07 2020(Updated: )
Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying the sympa.conf configuration file (which is owned by sympa) and parsing it through the setuid sympa_newaliases-wrapper executable.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/sympa | <=6.2.60~dfsg-4<=6.2.70~dfsg-2<=6.2.72~dfsg-1 | |
| Sympa | <=6.2.56 | |
| Sympa | =6.2.57-beta1 | |
| Sympa | =6.2.57-beta2 | |
| Fedora | =32 | |
| Fedora | =33 | |
| Fedora | =34 | |
| Debian | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/sympa-community/sympa/issues/1009
- https://github.com/sympa-community/sympa/issues/943#issuecomment-704779420
- https://github.com/sympa-community/sympa/issues/943#issuecomment-704842235
- https://salsa.debian.org/sympa-team/sympa/-/commit/b904d5257beb135127f663ad8f6865c1b59efd50
- https://security-tracker.debian.org/tracker/CVE-2020-26880
- https://lists.debian.org/debian-lts-announce/2020/11/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5CUVLHGWCDA6B2NH467ZMKL6O2NGLQZN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5MFWWYY4TSQAXBWZ6SBFX43BLUL3WWI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E2TKOL454ZKKLQCUSUPNEZ52WELN4OAH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2TKOL454ZKKLQCUSUPNEZ52WELN4OAH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5CUVLHGWCDA6B2NH467ZMKL6O2NGLQZN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5MFWWYY4TSQAXBWZ6SBFX43BLUL3WWI/
Frequently Asked Questions
What is the severity of CVE-2020-26880?
CVE-2020-26880 has a high severity level due to its potential for local privilege escalation to root access.
How do I fix CVE-2020-26880?
To fix CVE-2020-26880, update Sympa to version 6.2.60 or later.
Which versions of Sympa are affected by CVE-2020-26880?
CVE-2020-26880 affects Sympa versions up to 6.2.57b.2 and those specific versions listed in the advisory.
Can CVE-2020-26880 be exploited remotely?
No, CVE-2020-26880 requires local access to exploit the vulnerability.
What type of vulnerability is CVE-2020-26880?
CVE-2020-26880 is classified as a local privilege escalation vulnerability.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/author
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- vendor/sympa
- canonical/sympa
- version/sympa/6.2.56
- version/sympa/6.2.57-beta1
- version/sympa/6.2.57-beta2
- vendor/fedoraproject
- canonical/fedora
- version/fedora/32
- version/fedora/33
- version/fedora/34
- vendor/debian
- canonical/debian
- version/debian/9.0