Mailman-coders October 2017

mailman-coders@python.org

9 participants
22 discussions

[Bug 1724561] [NEW] Unable to remove certain lists

by Peter Mueller

Public bug reported: Hello, when I try to remove a mailing list by command line or API I get the following error: Removed list: mylist(a)example.org Traceback (most recent call last): File "/usr/local/mailman/bin/mailman", line 11, in <module> load_entry_point('mailman==3.2.0a1', 'console_scripts', 'mailman')() File "/usr/local/mailman/lib/python3.5/site-packages/mailman/bin/mailman.py", line 97, in main args.func(args) File "/usr/local/mailman/lib/python3.5/site-packages/mailman/database/transaction.py", line 50, in wrapper rtn = function(*args, **kws) File "/usr/local/mailman/lib/python3.5/site-packages/mailman/commands/cli_lists.py", line 278, in process remove_list(mlist) File "/usr/local/mailman/lib/python3.5/site-packages/mailman/app/lifecycle.py", line 120, in remove_list getUtility(IListManager).delete(mlist) File "/usr/local/mailman/lib/python3.5/site-packages/mailman/database/transaction.py", line 85, in wrapper return function(args[0], config.db.store, *args[1:], **kws) File "/usr/local/mailman/lib/python3.5/site-packages/mailman/model/listmanager.py", line 84, in delete notify(ListDeletingEvent(mlist)) File "/usr/local/mailman/lib/python3.5/site-packages/zope/event/__init__.py", line 31, in notify subscriber(event) File "/usr/local/mailman/lib/python3.5/site-packages/mailman/app/moderator.py", line 283, in handle_ListDeletingEvent requestsdb.delete_request(request.id) File "/usr/local/mailman/lib/python3.5/site-packages/mailman/database/transaction.py", line 85, in wrapper return function(args[0], config.db.store, *args[1:], **kws) File "/usr/local/mailman/lib/python3.5/site-packages/mailman/model/requests.py", line 140, in delete_request getUtility(IPendings).confirm(request.data_hash) File "/usr/local/mailman/lib/python3.5/site-packages/mailman/database/transaction.py", line 85, in wrapper return function(args[0], config.db.store, *args[1:], **kws) File "/usr/local/mailman/lib/python3.5/site-packages/mailman/model/pending.py", line 138, in confirm value = json.loads(keyvalue.value) File "/usr/lib64/python3.5/json/__init__.py", line 319, in loads return _default_decoder.decode(s) File "/usr/lib64/python3.5/json/decoder.py", line 339, in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end()) File "/usr/lib64/python3.5/json/decoder.py", line 355, in raw_decode obj, end = self.scan_once(s, idx) json.decoder.JSONDecodeError: Invalid \uXXXX escape: line 1 column 506 (char 505) ** Affects: mailman Importance: Undecided Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1724561 Title: Unable to remove certain lists To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1724561/+subscriptions

3 years, 11 months

[Bug 1721746] [NEW] [If member-email known] Malformed "From:" header accepted -> anyone can post to list.

by René Freund

*** This bug is a security vulnerability *** Private security bug reported: Hello, because we got some spam from outside, but with email-adress of a list- member lately, we found after an investigation that the E-Mail Header From: "memberuseremail@" <memberuserdomain.tld somerandomspamemail.tld> will be accepted by mailman and posted to the list. So if the spammer knows a valid member-emailadress it is possible to send emails to the list. I don't know if this is fixed already and i have to poke the ubuntu team instead. Versions: Ubuntu 16.04 LTS Mailman Version: 1:2.1.20-1ubuntu0.1 Postfix Version: 3.1.0-3 ** Affects: mailman Importance: Undecided Status: New ** Tags: email sender -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1721746 Title: [If member-email known] Malformed "From:" header accepted -> anyone can post to list. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1721746/+subscriptions

3 years, 11 months

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

Mailman-coders October 2017