{
  "cveId": "CVE-2021-34337",
  "url": "https://patchblox.com/security/cve/CVE-2021-34337",
  "summary": "CVE-2021-34337 is fixed in mailman3 on 1 platform, first by DEBIAN-CVE-2021-34337, released April 15, 2023. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "mailman3: An issue was discovered in Mailman Core before 3.3.5",
  "description": "An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.",
  "published": "2023-04-15T20:16:00Z",
  "severity": "medium",
  "cvss": 6.3,
  "cvssVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
  "epss": 0.00299,
  "epssPercentile": 0.22778,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "mailman3",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "3.3.7-1",
      "fix": "DEBIAN-CVE-2021-34337",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-34337",
      "released": "2023-04-15T20:16:00Z"
    },
    {
      "platform": "linux",
      "product": "mailman3",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3.3.7-1",
      "fix": "DEBIAN-CVE-2021-34337",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-34337",
      "released": "2023-04-15T20:16:00Z"
    },
    {
      "platform": "linux",
      "product": "mailman3",
      "release": "Debian 14",
      "fixedVersion": "3.3.7-1",
      "fix": "DEBIAN-CVE-2021-34337",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-34337",
      "released": "2023-04-15T20:16:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}