CVE catalog

CVE-2020-29668

sympa: CVE-2020-29668

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.98% · Oct 25, 2026

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansympasid6.2.76~dfsg-1.1fixed
Debiansympaforky6.2.76~dfsg-1.1fixed
Debiansympatrixie6.2.76~dfsg-1fixed
Debiansympabookworm6.2.70~dfsg-2+deb12u1fixed
Debiansympabookworm-security6.2.70~dfsg-2+deb12u1fixed
Ubuntusympapro6.2.40~dfsg-1vulnerable
Ubuntusympapro6.2.40~dfsg-3vulnerable
Ubuntusympapro6.2.40~dfsg-4vulnerable
Ubuntusympapro6.2.40~dfsg-4ubuntu0.20.04.1~esm1vulnerable
Ubuntusympapro6.2.40~dfsg-4ubuntu0.20.04.1~esm2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansympasourcesid6.2.58~dfsg-2not yet assignedNot reported[976020]
Debiansympasourceforky6.2.58~dfsg-2not yet assignedNot reported[976020]
Debiansympasourcetrixie6.2.58~dfsg-2not yet assignedNot reported[976020]
Debiansympasourcebookworm6.2.58~dfsg-2not yet assignedNot reported[976020]

[Debian bug #976020]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [sympa]Fixed
    Details (4)

    • 6.2.70~dfsg-2+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 6.2.58~dfsg-2

      dsa · sympa · debian · bookworm; dsa · sympa · debian · 12

    • 6.2.70~dfsg-2+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 6.2.58~dfsg-2

      dsa · sympa · debian · bookworm; dsa · sympa · debian · 12

    • 6.2.70~dfsg-2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 6.2.58~dfsg-2

      dsa · sympa · debian · bookworm; dsa · sympa · debian · 12

    • 6.2.70~dfsg-2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 6.2.58~dfsg-2

      dsa · sympa · debian · bookworm; dsa · sympa · debian · 12

[Debian 13 (Trixie)]

  • [sympa]Fixed
    Details (2)

    • 6.2.76~dfsg-1 · amd64 · trixie

      Fixed · Fixed: 6.2.58~dfsg-2

      dsa · sympa · debian · 13

    • 6.2.76~dfsg-1 · arm64 · trixie

      Fixed · Fixed: 6.2.58~dfsg-2

      dsa · sympa · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]