GNU Mailman 跨站请求伪造漏洞

GNU Mailman is a free suite of software from the GNU community for managing e-mail discussions and e-mail lists. The software integrates with Web projects to make it easy for users to manage email subscription accounts and provides built-in archiving, automatic forwarding processing, content...

mailman:2.1 security update

3:2.1.29-12.2 - Fix for CVE-2021-44227 - Resolves: 2026871 3:2.1.29-12.1 - Fix for CVE-2021-42096 - Fix for CVE-2021-42097 - Resolves: 2021139, 2020692...

PT-2021-6019

Name of the Vulnerable Software and Affected Versions GNU Mailman versions prior to 2.1.38 Description The issue is related to insufficient validation of the source of HTTP requests in GNU Mailman, allowing a remote attacker to force a victim to visit a special web page and perform arbitrary...

CVE-2021-43332

A flaw was found in mailman, where the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This flaw could potentially allow cracking of the password by a moderator utilizing an offline brute-force attack...

CVE-2021-43331

A flaw was found in mailman in the Cgi/options.py user options page. This flaw allows a malicious attacker to carry out a Cross-site Scripting attack by providing a crafted URL as input, leading to the execution of arbitrary JavaScript code. The highest threat from this vulnerability is...

RHEL 8 : mailman:2.1 (RHSA-2021:4838)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4838 advisory. Mailman is a program used to help manage e-mail discussion lists. Security Fixes: mailman: CSRF token bypass allows to perform CSRF attacks...

RHEL 8 : mailman:2.1 (RHSA-2021:4839)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4839 advisory. Mailman is a program used to help manage e-mail discussion lists. Security Fixes: mailman: CSRF token bypass allows to perform CSRF attacks...

RHEL 8 : mailman:2.1 (RHSA-2021:4837)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4837 advisory. Mailman is a program used to help manage e-mail discussion lists. Security Fixes: mailman: CSRF token bypass allows to perform CSRF attacks...

OESA-2021-1444 mailman security update

Mailman is free software for managing electronic mail discussion and e-newsletter lists. Mailman is integrated with the web, making it easy for users to manage their accounts and for list owners to administer their lists. Mailman supports built-in archiving, automatic bounce processing, content...

USN-5151-2 mailman vulnerabilities

USN-5151-1 fixed several vulnerabilities in Mailman. This update provides the corresponding update for Ubuntu 20.04 ESM. Original advisory details: It was discovered that Mailman incorrectly handled certain URL. An attacker could possibly use this issue to execute arbitrary code. CVE-2021-43331 I...

USN-5151-2: Mailman vulnerabilities

USN-5151-1 fixed several vulnerabilities in Mailman. This update provides the corresponding update for Ubuntu 20.04 ESM. Original advisory details: It was discovered that Mailman incorrectly handled certain URL. An attacker could possibly use this issue to execute arbitrary code. CVE-2021-43331 I...

mailman < 2.1.38 -- CSRF vulnerability of list mod or member against list admin page

Mark Sapiro reports: A list moderator or list member can potentially carry out a CSRF attack by getting a list admin to visit a crafted web page...

mailman: CSRF token derived from admin password allows offline brute-force attack

Sensitive information is exposed to unprivileged users in mailman. The hash of the list admin password is used to derive the CSRF Cross-site Request Forgery token, which is exposed to unprivileged members of a list. Malicious members may use the CSRF token to perform an offline brute-force attack...

mailman: CSRF token bypass allows to perform CSRF attacks and account takeover

A Cross-Site Request Forgery CSRF attack can be performed in mailman due to a CSRF token bypass. CSRF tokens are not checked against the right user and a token created by one user can be used by another one to perform a request, effectively bypassing the protection provided by CSRF tokens. A remo...

Important: Red Hat Security Advisory: mailman:2.1 security update

An update for the mailman:2.1 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

mailman: CSRF token derived from admin password allows offline brute-force attack

Sensitive information is exposed to unprivileged users in mailman. The hash of the list admin password is used to derive the CSRF Cross-site Request Forgery token, which is exposed to unprivileged members of a list. Malicious members may use the CSRF token to perform an offline brute-force attack...

mailman: CSRF token bypass allows to perform CSRF attacks and account takeover

A Cross-Site Request Forgery CSRF attack can be performed in mailman due to a CSRF token bypass. CSRF tokens are not checked against the right user and a token created by one user can be used by another one to perform a request, effectively bypassing the protection provided by CSRF tokens. A remo...

Important: Red Hat Security Advisory: mailman:2.1 security update

An update for the mailman:2.1 module is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

mailman: CSRF token derived from admin password allows offline brute-force attack

Sensitive information is exposed to unprivileged users in mailman. The hash of the list admin password is used to derive the CSRF Cross-site Request Forgery token, which is exposed to unprivileged members of a list. Malicious members may use the CSRF token to perform an offline brute-force attack...

mailman: CSRF token bypass allows to perform CSRF attacks and account takeover

A Cross-Site Request Forgery CSRF attack can be performed in mailman due to a CSRF token bypass. CSRF tokens are not checked against the right user and a token created by one user can be used by another one to perform a request, effectively bypassing the protection provided by CSRF tokens. A remo...