[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <66imbuhbqi4yjbtmpmvvri7sttmw3tmhtemh6pqjcp5kazdai3@cbzrad3k7t4l>
Date: Mon, 21 Apr 2025 20:45:55 +0300
From: Valtteri Vuorikoski <vuori@...com.org>
To: oss-security@...ts.openwall.com
Subject: Re: 3 new CVE's in old branch of GNU mailman
On Mon, Apr 21, 2025 at 12:52:24PM -0400, Thomas Ward wrote:
> Direct quoting the CVE:
>
> > *Affected Software:* GNU Mailman 2.1.39 (bundled with cPanel/WHM)
>
> I think that this would be a modified bundled version based on "Affected
> Software" specifically mentioning the GNU Mailman 2.1.39 that is
> specifically bundled with cPanel/WHM.
>
> Especially if you can't reproduce it in pure MM 2.1.39.
Yes, it says that, but IMO the wording in these CVEs could be a lot less
ambiguous. The focus of the text is on "GNU Mailman" and I don't think it's very
clear whether the parenthesized "bundled with" bit means that:
a) The vulnerability exists in mainline GNU Mailman, but it was discovered while
probing cPanel and/or reported through that vendor;
b) The vulnerability exists in mainline GNU Mailman, but is only exposed when
it is installed in a certain manner, which happens to be how cPanel does it,
but could also happen elsewhere; or
c) The vulnerability does not exist in the mainline version, but is due to
additional code authored by cPanel LLC.
So at the moment it seems to me that the correct interpretation is c). Hard to
tell because the modified source doesn't seem to be available in despite Mailman
being GPL. Maybe someone needs to ask cPanel LLC to mail them a CD?
I think this distinction is relevant because there are unfortunately quite a few
Mailman 2 instances still running despite its EOL status. I looked through the
mainline code a bit and luckily (again IMO) the codebase appears reasonably
security-conscious especially given its fairly advanced age, modulo a few nits
(likely non-consequential, but in particularly the method called do_command
(there's only one) may warrant scrutiny).
-Valtteri
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
