CVE-2021-46900: 
NixOS vulnerability analysis and mitigation

Sympa before version 6.2.62 contains a security vulnerability related to its cookie parameter implementation. The vulnerability, identified as CVE-2021-46900, was discovered where the system relies on a cookie parameter for critical security functions but fails to ensure its existence and unpredictability. This parameter serves dual purposes: as a salt for stored passwords and as an XSS protection mechanism in message archives (Sympa Advisory).

The vulnerability stems from the cookie parameter in the sympa.conf configuration file being used to generate unpredictable identifiers for the system. This parameter was specifically utilized as a salt for password encryption using the RC4 symmetric key algorithm (which is no longer considered secure) and as a protection mechanism against XSS attacks in message archives. The implementation had two critical flaws: the parameter needed to be unique per installation but couldn't be changed once set, and even when properly configured, it wasn't strong enough to resist brute force attacks (Sympa Advisory, GitHub Issue).

The vulnerability's impact is significant as it could allow attackers to achieve XSS attacks in message archives. Additionally, the weak implementation of the salt for stored passwords could potentially make password cracking easier. The issue is particularly severe for installations operating without setting the cookie parameter, as this completely invalidates the intended security measures (Sympa Advisory).

For systems that cannot immediately upgrade to the latest version, a temporary workaround is available. Administrators should set a value for the cookie parameter to mitigate security risks. However, for versions 6.2.40 or earlier, administrators must first upgrade RC4-encrypted passwords using upgrade_sympa_password.pl (for version 6.2.16 or later) or sympa.pl --md5_encode_password (for earlier versions). After setting the parameter, all Sympa services (Sympa services, WWSympa, Sympa SOAP service) must be restarted. The permanent solution is to upgrade to Sympa 6.2.62 or later, which no longer uses the cookie parameter (Sympa Advisory).