[<prev] [next>] [day] [month] [year] [list]
Message-ID: <a27e3c69-2e14-929c-0a57-42427760b778@oracle.com>
Date: Thu, 21 Oct 2021 12:04:47 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Mailman 2.1.35 security release
Quoting from Mark Sapiro's emails at:
https://mail.python.org/archives/list/mailman-announce@python.org/thread/IKCO6JU755AP5G5TKMBJL6IEZQTTNPDQ/
> A couple of vulnerabilities have recently been reported. Thanks to Andre
> Protas, Richard Cloke and Andy Nuttall of Apple for reporting these and
> helping with the development of a fix.
>
> CVE-2021-42096 could allow a list member to discover the list admin
> password.
>
> CVE-2021-42097 could allow a list member to create a successful CSRF
> attack against another list member enabling takeover of the members account.
>
> These attacks can't be carried out by non-members so may not be of
> concern for sites with only trusted list members.
> I am pleased to announce the release of Mailman 2.1.35.
>
> This is a security and minor bug fix release. See the attached
> README.txt for details. For those who just want a patch for the security
> issues, see
> https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1873.
> The patch is also attached to the bug reports at
> https://bugs.launchpad.net/mailman/+bug/1947639 and
> https://bugs.launchpad.net/mailman/+bug/1947640. The patch is the same
> on both and fixes both issues.
>
> As noted Mailman 2.1.30 was the last feature release of the Mailman 2.1
> branch from the GNU Mailman project. There has been some discussion as
> to what this means. It means there will be no more releases from the GNU
> Mailman project containing any new features. There may be future patch
> releases to address the following:
>
> i18n updates.
> security issues.
> bugs affecting operation for which no satisfactory workaround exists.
>
> Mailman 2.1.35 is the fifth such patch release.
>
> Mailman is free software for managing email mailing lists and
> e-newsletters. Mailman is used for all the python.org and
> SourceForge.net mailing lists, as well as at hundreds of other sites.
>
> For more information, please see our web site at one of:
>
> http://www.list.org
> https://www.gnu.org/software/mailman
> http://mailman.sourceforge.net/
>
> Mailman 2.1.35 can be downloaded from
>
> https://launchpad.net/mailman/2.1/
> https://ftp.gnu.org/gnu/mailman/
> https://sourceforge.net/projects/mailman/
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/alanc
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
