Privilege Escalation Vulnerability in HyperKitty Package
Summary
UBUNTU-CVE-2021-25322: A UNIX Symbolic Link (Symlink) Following vulnerability in python-HyperKitty of openSUSE Leap 15.2, Factory allows local attackers to escalate privileges from the user hyperkitty or hyperkitty-admin to root. Affects hyperkitty versions 1.1.4-2 – 1.1.4-4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HyperKitty is a web application that provides a user-friendly interface for managing mailing list archives. It is built on the Django framework and allows users to interact with their mailing lists through a web browser. The application is designed to be secure and efficient, but it has been found to have a vulnerability that could allow local attackers to escalate their privileges.
Vulnerability Detail
The vulnerability identified as CVE-2021-25322 is a UNIX Symbolic Link (Symlink) Following issue in the HyperKitty package. This flaw allows local attackers to escalate privileges from the user hyperkitty or hyperkitty-admin to root. The vulnerability affects specific versions of the HyperKitty package, particularly those prior to version 1.3.4-5.1 in openSUSE Factory and version 1.3.2-lp152.2.3.1 in openSUSE Leap 15.2. The potential ramifications include unauthorized access to sensitive system resources and data, which could lead to further exploitation of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the HyperKitty application to trusted users only, thereby minimizing the risk of exploitation until the package is updated.
Conclusion
The CVE-2021-25322 vulnerability in the HyperKitty package poses a significant risk by allowing local privilege escalation. It is crucial for users to update to the latest patched versions to mitigate this risk and ensure the security of their systems.
See every vulnerability recorded for hyperkitty →
FAQ
CVE-2021-25322 is a vulnerability in the HyperKitty package that allows local attackers to escalate their privileges to root.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Versions prior to 1.3.4-5.1 in openSUSE Factory and 1.3.2-lp152.2.3.1 in openSUSE Leap 15.2 are affected.
The CVSS score of this vulnerability is 6.8, indicating a medium severity level.
You can update the HyperKitty package using your package manager. For example, on Ubuntu, you can run 'sudo apt-get update' followed by 'sudo apt-get install python3-django-hyperkitty' to install the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for hyperkitty.
