Mailman 3 - Mailman-announce

The Mailman FAQ wizard (temporarily unavailable)
by Barry Warsaw 12 Oct '05

12 Oct '05

The Python.org administrators have moved the website to our spiffy new server, however the Mailman FAQ wizard hasn't yet been moved. It should be shortly. Please try not to make any changes to the FAQ wizard for the next day or so. Currently, until your DNS updates, you'll be hitting the wizard on the old machine -- at least until it gets disabled. When the database gets migrated, your changes may get lost. Then you may not have access to the new one until your DNS gets updated. I'll send out another message when the FAQ wizard has been successfully migrated. -Barry

1 1

[Fwd: LinuxWorld Expo 2005 .Org Village London]
by Barry Warsaw 17 Jun '05

17 Jun '05

Once again, I will not be able to attend, but if anybody is going and would like to help represent the Mailman project, please let myself and Brian know. -Barry

1 0

RELEASED Mailman 2.1.6
by Barry Warsaw 31 May '05

31 May '05

On behalf of the development team, I'm pleased to announce the release of GNU Mailman 2.1.6. This is a significant release, which includes three important security patches, updated Chinese (zh_TW and zh_CN) support, better compatibility with Python 2.4, a few new features, and many bug fixes. Mailman is free software for managing email mailing lists and e-newsletters. This release fixes CAN-2005-0202, a reported vulnerability in path traversal in the private archive script. This release also provides an option for sites to produce more cryptographically secure auto-generated passwords, and it closes a potential cross-site scripting hole. Because of the security (and other) fixes, it is highly recommended that all sites upgrade to 2.1.6. For more information, please see: http://www.list.org http://mailman.sf.net http://www.gnu.org/software/mailman On a personal note, I owe a debt of gratitude to Tokio Kikuchi, who served as release manager for 2.1.6, integrated countless patches, and coordinated the Chinese language updates for this release. Please join me in thanking him for helping out so much. For links to download the Mailman 2.1.6 source tarball, see: http://sourceforge.net/project/showfiles.php?group_id=103 Enjoy, -Barry

1 0

Mailman 2.1.6 release candidate 4
by Barry Warsaw 14 May '05

14 May '05

A few more last minute fixes and some language updates. Please let me know if you encounter any show stoppers. Barring any really critical bugs, this is going to be 2.1.6 final. -Barry https://sourceforge.net/project/shownotes.php?release_id=327367

1 0

Mailman 2.1.6 release candidate 3
by Barry Warsaw 29 Apr '05

29 Apr '05

Release candidate 3 for Mailman 2.1.6 is now available. This fixes a late-breaking problem with RFC 2231 encoded headers containing bogus or non-existent charsets. Specifically, this release includes an updated version of the email package (2.5.6). Please try this version out as much as possible. Hopefully Tokio and I will get a 2.1.6 final out in about two weeks. -Barry https://sourceforge.net/project/showfiles.php?group_id=103&package_id=69562…

1 0

Critical security update for Mailman 2.1.5 and earlier
by Barry Warsaw 10 Feb '05

10 Feb '05

There is a critical security flaw in Mailman 2.1.5 and earlier Mailman 2.1 versions which can allow remote attackers to gain access to member passwords under certain conditions. The extent of the vulnerability depends on what version of Apache you are running, and (possibly) how you have configured your web server. However, the flaw is in Mailman and has been fix in CVS and will be included in the Mailman 2.1.6 release. This issue has been assigned CVE number CAN-2005-0202. We currently believe that Apache 2.0 sites are not vulnerable, and that many if not most Apache 1.3 sites are. In any event, the safest approach is to assume the worst and take the remediation steps indicated below as soon as possible. The quickest fix is to remove the /usr/local/mailman/cgi-bin/private executable. This will disable all access to all private archives on your system. While this is the quickest and easiest way to close the hole, it will also break all your private archives. If all the lists on your site only run public archives, this won't matter to you. Until Mailman 2.1.6 is released, the longer term fix is to apply this patch: http://www.list.org/CAN-2005-0202.txt For additional piece of mind, it is recommended that you regenerate your member passwords. Instructions on how to do this, and more information about this vulnerability are available here: http://www.list.org/security.html My thanks to Tokio Kikuchi, Mark J Cox, and the folks on vendor-sec. This issue was found by Marcus Meissner. -Barry

1 0

Mailman 2.1.6 beta 1
by Barry Warsaw 16 Jan '05

16 Jan '05

I put together a tarball for Mailman 2.1.6 beta 1, but unfortunately SourceForge's file upload machine is out of disk space. For now you can get the file from: http://www.list.org/mailman-2.1.6b1.tgz I'll get that uploaded to SF as soon as possible. Huge thanks go out to Tokio Kikuchi for all his great work on this release. -Barry

1 1

Updated web sites
by Barry Warsaw 23 Dec '04

23 Dec '04

I've finally regained access to all three websites, list.org, mailman.sf.net, and the GNU mirror, so I've pushed out the latest updates. There are the usual additions to the list of users, but much more importantly there's Terri's new user documentation, and my recent consolidation of the installation documentation. There's also a very incomplete list administrator's guide on the site (volunteers to help polish this up are welcome!). Please poke around the site, read the documentation and let us know if you find any errors. Note that the GNU mirror always lags a bit behind the other two sites. http://www.list.org should be up-to-date. Enjoy, -Barry

1 0

RELEASED Mailman 2.1.5
by Barry Warsaw 15 May '04

15 May '04

Today I am releasing Mailman 2.1.5, a bug fix release that also contains new support for the Turkish language, and a few minor new features. Mailman 2.1.5 is a significant upgrade which should improve disk i/o performance, administrative overhead for discarding held spams, and the behavior of bouncing member disables. This version also contains a fix for an exploit that could allow 3rd parties to retrieve member passwords. It is thus highly recommended that all existing sites upgrade to the latest version. The full source tarball, as well as a patch against Mailman 2.1.4 have been made available. See http://sourceforge.net/project/showfiles.php?group_id=103 for links to downloads. NOTE: You will want to read the UPGRADING file for important information regarding upgrading from earlier version to Mailman 2.1.5. A number of internal file formats have changed so you must shut down web and mail access to Mailman before you upgrade. You will also want to re-run configure (i.e. config.status) before you run "make install". See also: http://www.list.org http://mailman.sf.net http://www.gnu.org/software/mailman Finally, a personal note. I have left Zope Corporation to join Secure Software, a company started by John Viega -- Mailman's original author. Although I won't be working on Mailman in any official capacity, it is exciting to be working with him and the rest of the folks there. I leave Zope Corp on a positive note and wish nothing but success for them too. You can find Secure Software on the web at http://www.securesoftware.com. Please continue to use my barry(a)python.org email address for all Mailman correspondences. I don't expect much to change for the Mailman project at all. Enjoy, -Barry 2.1.5 (15-May-2004) - The admindb page has a checkbox that allows you to discard all held messages that are marked Defer. On heavy lists with lots of spam holds, this makes clearing them much faster. - The qrunner system has changed to use only one file per message. However the configuration variable METADATA_FORMAT has been removed, and support for SAVE_MSGS_AS_PICKLES has been changed. The latter no longer writes messages as plain text. Instead, they are stored as pickles of plain strings, using the text pickle format. This still makes them non-binary files readable and editable by humans. bin/dumpdb also works differently. It will print out the entire pickle file (with more verbosity) and if used with 'python -i', it binds msg to a list of all objects found in the pickle file. Removed from Defaults.py: PENDINGDB_LOCK_TIMEOUT, PENDINGDB_LOCK_ATTEMPTS, METAFMT_MARSHAL, METAFMT_BSDDB_NATIVE, METAFMT_ASCII, METADATA_FORMAT - The bounce processor has been redesigned so that now when an address's bounce score reaches the threshold, that address will be sent a probe message. Only if the probe bounces will the address be disabled. The score is reset to zero when the probe is sent. Also, bounce events are now kept in an event file instead of in memory. This should help contain the bloat of the BounceRunner. New supporting variables in Defaults.py: VERP_PROBE_FORMAT, VERP_PROBE_REGEXP REGISTER_BOUNCES_EVERY is promoted to a Defaults.py variable. - The pending database has been changed from a global pickle file, to a unique pickle file per mailing list. - The 'request' database file has changed from a marshal, to the more secure pickle format. - Disallow multiple password retrievals. - The email package is updated to version 2.5.5. - New language: Turkish. - Bugs and patches: 869644, 869647 (NotAMemberError for old cookie data), 878087 (bug in Slovenian catalog), 899263 (ignore duplicate pending ids), 810675 (discard all defers button)

1 0

Mailman 2.1.5 release candidate 2
by Barry Warsaw 26 Apr '04

26 Apr '04

I've just uploaded Mailman 2.1.5 release candidate 2 (no, you never saw rc1 :). Since there are some fairly significant changes with this version, I felt it was necessary to put out a release candidate to hopefully prompt some additional testing. If you're able to test the new version, that would be great, but please note that: * The file format for on-disk messages in the qrunners has changed. Until now, each queued message was represented by two files, a .msg and a .pck file. With this version, all information is kept in the .pck file. This improves stability and performance. The upgrade script will attempt to convert all your existing .msg/.pck files to the single .pck file, but there may still be lurking problems with this conversion. * The pending database has been changed from a global pickle file living in $prefix/data, to a unique pickle file per mailing list. The upgrade script attempts to determine which list each pending request belongs to, but it isn't always possible to know, so while it does the best it can, there may still be lurking problems with this conversion. If you upgrade you should do so only on a quiet system. I recommend shutting down Mailman, your MTA, and your web server before doing the upgrade. Please note any problems you have with the conversion scripts (you may want to make backups first ;). My thanks for not letting the above discourage you from testing the new version. :) I think the improvements in 2.1.5 are worth it, and based on experiences running python.org, the new version should be quite stable once installed. I plan to release 2.1.5 final sometime next weekend. -Barry

1 1