CVE-2020-29668: 
NixOS vulnerability analysis and mitigation

CVE-2020-29668 affects Sympa versions before 6.2.59b.2, a mailing list manager software. The vulnerability was discovered in November 2020 and publicly disclosed in December 2020. The issue allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun (Debian LTS, NVD).

The vulnerability stems from improper validation of cookie values in the SOAP API authentication mechanism. When a SOAP request contains an arbitrary string as a cookie (e.g., "asdkjasdljkahsdlkjh"), the system replies with an error ("Undefined session ID in cookie") but still executes the requested operations. This behavior occurs specifically in the authenticateAndRun function. The vulnerability has a CVSS v3.1 Base Score of 3.7 (Low) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD, GitHub Issue).

An attacker could exploit this vulnerability to manipulate mailing lists without proper authentication, including subscribing emails or accessing the list of subscribers. The impact is particularly significant if the SOAP endpoint is enabled in the Sympa installation (Debian LTS).

The vulnerability can be exploited by sending a SOAP request with any arbitrary string as the cookie value, except for an expired cookie. The exploitation requires the SOAP API to be enabled in the target system. A proof of concept was documented showing that when using an arbitrary string as a cookie, the system would execute requests despite showing an error message (GitHub Issue).

The vulnerability was fixed in Sympa version 6.2.59b.2. Various distributions have released security updates: Debian 9 (stretch) fixed it in version 6.2.16~dfsg-3+deb9u5, Debian 10 (buster) in version 6.2.40~dfsg-1+deb10u1, and Fedora in version 6.2.60. System administrators are advised to upgrade to the fixed versions (Debian Security, Fedora Update).