-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mailman | pip | < 3.3.5 | 3.3.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from non-constant-time password comparison in the REST API authentication. The critical function is the password checker in the authentication module. The patch changes the comparison mechanism to use constant-time hmac.compare_digest, directly indicating the previous vulnerable implementation was in this authentication check function. The AdminAuthenticationPolicy's credential checker is the logical location for this comparison in Mailman's REST architecture.