[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <49c8a7b7-0200-4bc6-bfca-4f376dcb3d25@wichmann.us>
Date: Mon, 21 Apr 2025 10:53:28 -0600
From: Mats Wichmann <mats@...hmann.us>
To: oss-security@...ts.openwall.com
Subject: Re: 3 new CVE's in old branch of GNU mailman
On 4/21/25 10:08, Alan Coopersmith wrote:
> 3 new CVE's have been published for GNU Mailman 2.1.39, as bundled with
> cPanel
> and WHM, credited to Firudin Davudzada and Musazada Aydan.
>
> Note that upstream declared GNU Mailman 2.1 (which requires Python 2),
> to be
> end of life back in 2020, and recommends migrations to Mailman 3 (which
> uses Python 3 instead):
Sadly, a lot of people are stuck with these bundled environments from
hosting services where the provider isn't going to provide any kind of
upgrade path to Mailman 3. That's neither here nor there as to the
vulnerabilities, just an observation (e.g. an open source project I work
on gets free mailing list services from Pair Networks, a feature they've
deprecated, although they promised at the time not to cut off existing
lists. 2.1.39 only...).
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
