Package: sympa
Severity: grave
Tags: fixed-upstream security patch

Hello,

A security vulnerability has been identified in WWSympa before version 6.2.80

Due to a flaw in how message file paths are handled in the archive
component (arc), unauthenticated or unauthorized users could
potentially fetch deleted or raw message files that should not be accessible.

This issue has been fixed upstream in 6.2.80 via:
https://github.com/sympa-community/sympa/pull/2068

There is no CVE identifier assigned yet, but we have been informed of
active exploitation / real-world attacks using this vulnerability.

This issue affects all current versions in Debian.

We have backported the upstream patch for Debian versions 10, 11, 12,
and 13. The corresponding patches are attached to this report.

Thanks for maintaining Sympa in Debian!

Regards,