CVE-2021-33038: HyperKitty - Exposure of Sensitive Information
Summary
CVE-2021-33038: Exposure of sensitive information to an unauthorized actor in HyperKitty. Affects hyperkitty versions < 1.3.5. Fixed in 1.3.5. How to fix ↓
Also tracked for
- hyperkitty · Debian:11
The same CVE-2021-33038 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
HyperKitty is a package available on PyPI that provides a web interface for accessing and managing mailing list archives. It is commonly used for migrating mailing list archives from Mailman 2 to Mailman 3. HyperKitty allows users to import and view mailing list archives, providing a convenient way to access historical discussions and information. However, prior to version 1.3.5, there was a vulnerability in the import functionality that could expose sensitive information during the migration process.
Vulnerability Detail
The vulnerability (CVE-2021-33038) in HyperKitty arises from a flaw in the 'hyperkitty_import.py' management command. When importing archives from a private mailing list, these archives become publicly visible for the duration of the import process. This means that sensitive information, which was previously restricted to authorized users, could be accessible to unauthorized actors during a migration from Mailman 2 to Mailman 3. The exposure of this sensitive information could lead to various consequences, such as unauthorized access to confidential discussions or the leakage of personally identifiable information (PII). The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 1.3.12 as of 23 Oct 2026
pip install --upgrade "hyperkitty==1.3.12"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.5
This is the first release that contains the fix.
pip install --upgrade "hyperkitty==1.3.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by avoiding the import of private mailing list archives during periods when unauthorized access is a concern. Additionally, users can closely monitor the import process and ensure that the archives are not publicly accessible during the migration.
Conclusion
In conclusion, the vulnerability (CVE-2021-33038) in HyperKitty exposes sensitive information from private mailing list archives during the import process. To mitigate this risk, it is crucial to upgrade to HyperKitty version 1.3.5 or later. By doing so, the vulnerability is patched, and the sensitive information remains protected. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hyperkitty →
FAQ
HyperKitty is a package available on PyPI that provides a web interface for accessing and managing mailing list archives.
The vulnerability allows unauthorized actors to access sensitive information from private mailing list archives during the import process, potentially leading to unauthorized access to confidential discussions or the leakage of personally identifiable information (PII).
To fix this vulnerability, it is recommended to upgrade HyperKitty to version 1.3.5 or later.
While there is no specific workaround mentioned, users can mitigate the risk by avoiding the import of private mailing list archives during periods when unauthorized access is a concern.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for hyperkitty.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
