CVE-2020-26880

Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying the sympa.conf configuration file (which is owned by sympa) and parsing it through the setuid sympa_newaliases-wrapper executable.

Link	Resource
https://github.com/sympa-community/sympa/issues/943#issuecomment-704779420	Third Party Advisory
https://github.com/sympa-community/sympa/issues/943#issuecomment-704842235	Third Party Advisory
https://github.com/sympa-community/sympa/issues/1009	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/11/msg00015.html	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E2TKOL454ZKKLQCUSUPNEZ52WELN4OAH/	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5MFWWYY4TSQAXBWZ6SBFX43BLUL3WWI/	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5CUVLHGWCDA6B2NH467ZMKL6O2NGLQZN/	Mailing List Third Party Advisory

Configuration 1

cpe:2.3:a:sympa:sympa:6.2.57:beta1:*:*:*:*:*:* cpe:2.3:a:sympa:sympa:6.2.57:beta2:*:*:*:*:*:* cpe:2.3:a:sympa:sympa:*:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

---

Published : 2020-10-07 06:15

Updated : 2022-11-16 02:50

---

NVD link : CVE-2020-26880

Mitre link : CVE-2020-26880

No products.

CWE-269