debian/mailman3 vulnerabilities

Latest debian/mailman3 CVEs

Newest publication first

1. CVE-2025-53882 The logrotate configuration in the python-mailman of openSUSE allows the mailman user to sent SIGHUP to arbitrary proceess

   Published 2025-07-23

   Medium·CVSS 4.8 EPSS 0.15%

   A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSE mailman3 package allows the mailman user to sent SIGHUP to arbitrary processes. This issue affects openSUSE Tumbleweed: from ? before 3.3.10-2.1.

2. CVE-2021-34337 Mailman Core vulnerable to timing attacks

   Published 2023-04-15

   Medium·CVSS 6.3 EPSS 0.30%

   An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ab...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.