{"action":"Upgrade mailman to 3.3.5 or later.","affected":[{"fixed":"3.3.5","introduced":"0"}],"component":"mailman","cve_ids":["CVE-2021-34337"],"ecosystem":"PyPI","epss":0.00299,"exploited":false,"fixed_versions":["3.3.5"],"ghsa_id":"GHSA-2jg5-xgvv-4wq7","id":"tcs_01M5KGJYPZ0HKQEBKJ32TBS4QX","modified_at":"2026-06-10T17:00:42.208843999Z","published_at":"2023-04-15T20:16:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-22","https://gitlab.com/mailman/mailman/-/commit/e4a39488c4510fcad8851217f10e7337a196bb51","https://gitlab.com/mailman/mailman/-/tags","https://gitlab.com/mailman/mailman/-/issues/911","https://github.com/advisories/GHSA-2jg5-xgvv-4wq7"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2023-22","url":"https://osv.dev/vulnerability/PYSEC-2023-22"}],"summary":"An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrar"}