CVE-2020-29668: Medium severity sympa vulnerability
Published Nov 28, 2020
·Updated
Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.
Affected Software
9 affected componentsFixes available
debian/sympa<=6.2.40~dfsg-7, <=6.2.40~dfsg-1
6.2.58~dfsg-26.2.40~dfsg-1+deb10u1
debian/6.2.16~dfsg-3+deb9u4<=undefined
debian/sympa
6.2.60~dfsg-46.2.70~dfsg-26.2.72~dfsg-1
sympa sympa<=6.2.58
sympa sympa=6.2.59-beta1
Fedoraproject Fedora=32
Fedoraproject Fedora=33
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Remediation
Patch Available
Patch Available
Event History
Nov 28, 2020
Data Sourced
via Debian·12:03 PM
SeverityAffected Software
Dec 10, 2020
CVE Published
via MITRE·07:53 AM
Data Sourced
via MITRE·07:53 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-29668?
CVE-2020-29668 is rated as a high severity vulnerability due to its impact on the SOAP API authentication process.
2
How do I fix CVE-2020-29668?
To fix CVE-2020-29668, upgrade to Sympa versions 6.2.60~dfsg-4 or 6.2.70~dfsg-2 or later.
3
What versions of Sympa are affected by CVE-2020-29668?
CVE-2020-29668 affects Sympa versions up to and including 6.2.58.
4
Can CVE-2020-29668 be exploited remotely?
Yes, CVE-2020-29668 allows remote attackers to gain unauthorized SOAP API access.
5
Is there a specific cookie value that bypasses authentication in CVE-2020-29668?
Any arbitrary string can be used as a cookie value to exploit CVE-2020-29668, except for those from expired cookies.