Mailman 3 October 2015 - Mailman-coders

[Bug 1459236] [NEW] Mailman/Postfix integration doesn't generate virtual maps for all site list domains.
by Mark Sapiro 02 Feb '16

02 Feb '16

Public bug reported: An address of the form mailman(a)example.com is exposed on the web admin and listinfo overview pages where 'mailman' is the name of the site list and 'example.com' is the 'email domain' associated with the host in the URL of the page. This means that the 'mailman' address should work in all Postfix virtual domains and Mailman/MTA/Postfix.py should generate virtual mappings for that. ** Affects: mailman Importance: Medium Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1459236 Title: Mailman/Postfix integration doesn't generate virtual maps for all site list domains. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1459236/+subscriptions

2 3

[Bug 1447445] [NEW] Web subscribe can fail in cases of load balancers or other devices.
by Mark Sapiro 02 Feb '16

02 Feb '16

Public bug reported: The fix for (LP: #1082746) implemented a SUBSCRIBE_FORM_SECRET feature. If this is enabled by a site, the subscribe form on the listinfo page contains a hidden input field which includes a hash of various data including the IP address that the GET of the listinfo came from. Upon submission of the form, this hash is recomputed using the IP address that the POST of the form came from, and if the hashes don't match, the subscribe fails. This can cause legitimate subscribes to fail if the user is connected via a load balancer or other device which submits http(s) requests using a possibly different IP for each request. ** Affects: mailman Importance: Medium Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1447445 Title: Web subscribe can fail in cases of load balancers or other devices. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1447445/+subscriptions

2 3

[Bug 1444673] [NEW] Anonymous lists can expose the sending domain.
by Mark Sapiro 02 Feb '16

02 Feb '16

Public bug reported: Headers DKIM-Signature:, DomainKey-Signature: and Authentication- Results: are not removed by default from mail to an anonymous list. These headers can reveal the sending domain. ** Affects: mailman Importance: Medium Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1444673 Title: Anonymous lists can expose the sending domain. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1444673/+subscriptions

2 4

[Bug 1442298] [NEW] Find member does not match name in multibyte characters
by KOMEDA Shinji 02 Feb '16

02 Feb '16

Public bug reported: findmember encoding is not match menber name encoding. ** Affects: mailman Importance: Undecided Status: New ** Patch added: "findmember.patch" https://bugs.launchpad.net/bugs/1442298/+attachment/4370718/+files/findmemb… -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1442298 Title: Find member does not match name in multibyte characters To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1442298/+subscriptions

3 5

[Bug 1501762] [NEW] Security issues: passwords are stored in plaintext
by Steeve McCauley 01 Oct '15

01 Oct '15

*** This bug is a security vulnerability *** Public security bug reported: Passwords for the mailing list users are stored in plaintext, and mailed to the users each month as "reminders" by default. Passwords should be hashed securely using modern hashing methods and the password thrown away. Mailing passwords in plaintext is something that was acceptable in 1992, barely. Doing so in 2015 is insane. At the very least the default setting of mailing out users passwords in plaintext should be eliminated. Password recovery methods should be modernized. ** Affects: mailman Importance: Undecided Status: New ** Information type changed from Private Security to Public Security -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1501762 Title: Security issues: passwords are stored in plaintext To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1501762/+subscriptions

2 1