DSA-4922-1: hyperkitty - security update
Summary
DSA-4922-1: hyperkitty - security update. Affects hyperkitty versions < 1.2.2-1+deb10u1. Fixed in 1.2.2-1+deb10u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hyperkitty is a web user interface that provides access to Mailman 3 archives. It allows users to browse, search, and interact with mailing list archives. This vulnerability affects Hyperkitty version 1.2.2-1+deb10u1 and earlier.
Vulnerability Detail
The import functionality of Hyperkitty did not restrict the visibility of private archives during the import process. This means that when importing a private Mailman 2 archive, the archive was publicly accessible until the import completed. This could lead to unauthorized access to sensitive information during the import process.
How To Fix
Minimum fixed version
1.2.2-1+deb10u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade hyperkittyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The import functionality of Hyperkitty in versions prior to 1.2.2-1+deb10u1 allowed unauthorized access to private archives during the import process. To mitigate this vulnerability, it is recommended to upgrade to the latest version of the hyperkitty package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hyperkitty →
FAQ
Hyperkitty is a web user interface for Mailman 3 archives that allows users to browse, search, and interact with mailing list archives.
This vulnerability allows unauthorized access to private archives during the import process, potentially exposing sensitive information.
You can check the version of Hyperkitty installed on your system by running the command 'hyperkitty --version'.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of the hyperkitty package.
You can find more information about this vulnerability on the Debian security tracker page for hyperkitty: https://security-tracker.debian.org/tracker/hyperkitty
Related vulnerabilities
Recent vulnerabilities recorded for hyperkitty.
