mailman: CSRF token derived from admin password allows offline brute-force attack

Sensitive information is exposed to unprivileged users in mailman. The hash of the list admin password is used to derive the CSRF Cross-site Request Forgery token, which is exposed to unprivileged members of a list. Malicious members may use the CSRF token to perform an offline brute-force attack...

Important: Red Hat Security Advisory: mailman:2.1 security update

An update for the mailman:2.1 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

mailman: CSRF token derived from admin password allows offline brute-force attack

Sensitive information is exposed to unprivileged users in mailman. The hash of the list admin password is used to derive the CSRF Cross-site Request Forgery token, which is exposed to unprivileged members of a list. Malicious members may use the CSRF token to perform an offline brute-force attack...

mailman: CSRF token bypass allows to perform CSRF attacks and account takeover

A Cross-Site Request Forgery CSRF attack can be performed in mailman due to a CSRF token bypass. CSRF tokens are not checked against the right user and a token created by one user can be used by another one to perform a request, effectively bypassing the protection provided by CSRF tokens. A remo...

Important: Red Hat Security Advisory: mailman:2.1 security update

An update for the mailman:2.1 module is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

mailman: CSRF token bypass allows to perform CSRF attacks and account takeover

A Cross-Site Request Forgery CSRF attack can be performed in mailman due to a CSRF token bypass. CSRF tokens are not checked against the right user and a token created by one user can be used by another one to perform a request, effectively bypassing the protection provided by CSRF tokens. A remo...

mailman: CSRF token derived from admin password allows offline brute-force attack

Sensitive information is exposed to unprivileged users in mailman. The hash of the list admin password is used to derive the CSRF Cross-site Request Forgery token, which is exposed to unprivileged members of a list. Malicious members may use the CSRF token to perform an offline brute-force attack...

Important: Red Hat Security Advisory: mailman:2.1 security update

An update for the mailman:2.1 module is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

mailman:2.1 security update

3:2.1.29-12.1 - Fix for CVE-2021-42096 - Fix for CVE-2021-42097 - Resolves: 2021139, 2020692...

Important: Red Hat Security Advisory: mailman:2.1 security update

An update for the mailman:2.1 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

mailman: CSRF token derived from admin password allows offline brute-force attack

Sensitive information is exposed to unprivileged users in mailman. The hash of the list admin password is used to derive the CSRF Cross-site Request Forgery token, which is exposed to unprivileged members of a list. Malicious members may use the CSRF token to perform an offline brute-force attack...

mailman: CSRF token bypass allows to perform CSRF attacks and account takeover

A Cross-Site Request Forgery CSRF attack can be performed in mailman due to a CSRF token bypass. CSRF tokens are not checked against the right user and a token created by one user can be used by another one to perform a request, effectively bypassing the protection provided by CSRF tokens. A remo...

ALSA-2021:4826 Important: mailman:2.1 security update

Mailman is a program used to help manage e-mail discussion lists. Security Fixes: mailman: CSRF token bypass allows to perform CSRF attacks and account takeover CVE-2021-42097 mailman: CSRF token derived from admin password allows offline brute-force attack CVE-2021-42096 For more details about t...

mailman:2.1 security update

An update is available for mailman. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mailman is a program used to help manage e-mail discussion lists. Security...

Important: mailman:2.1 security update

Mailman is a program used to help manage e-mail discussion lists. Security Fixes: mailman: CSRF token bypass allows to perform CSRF attacks and account takeover CVE-2021-42097 mailman: CSRF token derived from admin password allows offline brute-force attack CVE-2021-42096 For more details about t...

RLSA-2021:4826 Important: mailman:2.1 security update

Mailman is a program used to help manage e-mail discussion lists. Security Fixes: mailman: CSRF token bypass allows to perform CSRF attacks and account takeover CVE-2021-42097 mailman: CSRF token derived from admin password allows offline brute-force attack CVE-2021-42096 For more details about t...

Information Disclosure

mailman:bionic is vulnerable to information disclosure. The CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password enabling brute-force attacks...

Cross-site Scripting (XSS)

mailman:bionic is vulnerable to cross-site scripting XSS attacks. A crafted URL to the user options page in Cgi/options.py results in arbitrary JavaScript executions...

Security fix for the ALT Linux 9 package mailman version 5:2.1.37-alt1

5:2.1.37-alt1 built Nov. 19, 2021 Dmitry V. Levin in task 289143 Nov. 13, 2021 Dmitry V. Levin - 2.1.36 - 2.1.37 fixes bug in the fix for CVE-2021-43332...

Ubuntu: Security Advisory (USN-5151-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...