Mailman 3 January 2020 - Mailman-coders

[Bug 1810098] [NEW] Some security log messages have missing or incorrect information
by Mark Sapiro 12 Jan '20

12 Jan '20

Public bug reported: Various failed authentications are reported in the security log, but there are issues: 'options' identifies itself as 'private'. 'roster' doesn't report the user if available. 'create' and 'rmlist' don't log authentication failures. ** Affects: mailman Importance: Medium Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1810098 Title: Some security log messages have missing or incorrect information To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1810098/+subscriptions

2 3

[Bug 1818205] [NEW] qrunner --runners=All blocks one CPU core
by Michael Lutonsky 12 Jan '20

12 Jan '20

Public bug reported: When runner qrunner with --runners=All it calls all defined runners in an endless loop[1]. Most of the time the runners have nothing to do and quickly reach the point where they shut down again[2]. Note that this happens before they sleep in self._snooze(), which is intended to prevent a busy-loop. After that, the runners get started again without delay, in an endless loop, eating up a CPU core. As far as I know this should happen in any mailman2.1 setup when using qrunner with --runners=All. [1]: https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/bin/qru… [2]: https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/Mailman… ** Affects: mailman Importance: Undecided Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1818205 Title: qrunner --runners=All blocks one CPU core To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1818205/+subscriptions

3 4

[Bug 1831777] [NEW] The site list -owner, -request and -bounces addresses in virtual domains aren't deliverable.
by Mark Sapiro 12 Jan '20

12 Jan '20

Public bug reported: The site list -owner, -request and -bounces addresses in virtual domains are used/exposed in password reminder emails and should be deliverable. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1831777 Title: The site list -owner, -request and -bounces addresses in virtual domains aren't deliverable. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1831777/+subscriptions

2 3

[Bug 1851442] [NEW] MailList.AddMember crashes in a certain condition
by Yasuhito FUTATSUKI＠POEM 12 Jan '20

12 Jan '20

Public bug reported: MailList.AddMember crashes with UnicodeDecodeError if all conditions below are satisfied. * subscribe_policy of the lists is 1 or 3 (user confirmaion required) * charset of preferred_language of the list is other than us-ascii * translation for ' from %(remote)s' in the language contains other than us-ascii character the patch attached may fix it. ** Affects: mailman Importance: Undecided Status: New ** Patch added: "fix_AddMember_patch.txt" https://bugs.launchpad.net/bugs/1851442/+attachment/5303123/+files/fix_AddM… ** Branch linked: lp:mailman/2.1 -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1851442 Title: MailList.AddMember crashes in a certain condition To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1851442/+subscriptions

2 2

[Bug 1859104] [NEW] It is possible to mailbomb a third party by repeatedly posting the subscribe form.
by Mark Sapiro 12 Jan '20

12 Jan '20

Public bug reported: This can be prevented by refusing to pend a subscription when one is already pending, but that means if a subscriber loses or doesn't receive the confirmation request email, she has to wait PENDING_REQUEST_LIFE (default 3 days) before she can request another. It can also be avoided by setting the list's subscribe_policy to Moderate, but that may not be desirable in many cases. Because of these considerations, I will implement the refusal to pend a subscription when one is already pending, but make that depend on a new REFUSE_SECOND_PENDING mm_cfg.py setting. ** Affects: mailman Importance: Medium Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1859104 Title: It is possible to mailbomb a third party by repeatedly posting the subscribe form. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1859104/+subscriptions

2 3

[Bug 1785854] [NEW] TypeError from confirm CGI.
by Mark Sapiro 12 Jan '20

12 Jan '20

Public bug reported: We have seen some massive, robotic subscribes and confirmations. In rare cases a TypeError can be thrown. This occurs because in processing, the CGI script retrieves the pending entry more than once. If the initial retrieval returns None, an appropriate message is returned, but if two clients confirm the same token at the same time, both initial retrievals may succeed, but then subsequent processing locks the list and retrieves the data again. The first client to get there processes the confirmation which removes the token. Then when the list is unlocked, the second client gets None for the pending data and throws TypeError when retrieving things from None. ** Affects: mailman Importance: Undecided Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1785854 Title: TypeError from confirm CGI. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1785854/+subscriptions

2 3

[Bug 1805137] [NEW] Bounces sent from opensmtpd not parsed
by Cristiano de Paula Costa 12 Jan '20

12 Jan '20

Public bug reported: Hi, We have updated our external MTA to use OpenBSD(6.4) and opensmptd. After we updated, mailman started to send "bounce message w/no discernable addresses" messages to us (list admins). It seems that mailman is not able to parse bounce messages sent from opensmtpd. Please check an example of a bounce message from opensmtpd: Hi! This is the MAILER-DAEMON, please DO NOT REPLY to this email. An error has occurred while attempting to deliver a message for the following list of recipients: XXXXXXXXX(a)live.com: 550 5.5.0 Requested action not taken: mailbox unavailable. [VE1EUR02FT047.eop-EUR02.prod.protection.outlook.com] Below is a copy of the original message: We are using mailman 2.1.11 and I could not test the issue on version 2.1.17. But, reading the code, it seem that the problem is still there. We managed to fix the problem by editing the file 'mailman/Mailman/Bouncers/SimpleMatch.py' and including the following lines: 191,194d190 < # opensmtpd < (_c('An error has occurred while attempting to deliver a message for'), < _c('Below is a copy of the original message'), < _c('^\s*(?P<addr>[^\s@]+@[^\s@]+)')), patch follows attached Regards, Cristiano ** Affects: mailman Importance: Undecided Status: New ** Patch added: "SimpleMatch.py.patch" https://bugs.launchpad.net/bugs/1805137/+attachment/5216458/+files/SimpleMa… -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1805137 Title: Bounces sent from opensmtpd not parsed To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1805137/+subscriptions

3 7

[Bug 1818872] [NEW] Trailing spaces in the email address cause login failures.
by Mark Sapiro 12 Jan '20

12 Jan '20

Public bug reported: Login to the user options page and private archives authentication fails if the email address has trailing spaces. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1818872 Title: Trailing spaces in the email address cause login failures. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1818872/+subscriptions

2 3

[Bug 1831321] [NEW] the List-Id field is filled without < and > around the list-id if the description contains unsupported characters
by Florian Schlegel 12 Jan '20

12 Jan '20

Public bug reported: According to rfc2919 the List-Id field should be formated like this: list-id-header = "List-ID:" [phrase] "<" list-id ">" CRLF This works as long as description is left blank or contains supported characters. In my case the description was as follows: �ffentliche Supportliste As you can see the umlaut "Ö" got broken while importing the list from an old server. Unfortunately I don't know how the import was done. The field is still present but < and > around the list-id are missing. This is problematic with procmail and other mail filters. ** Affects: mailman Importance: Undecided Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1831321 Title: the List-Id field is filled without < and > around the list-id if the description contains unsupported characters To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1831321/+subscriptions

3 6

[Bug 1845751] [NEW] cc modification due to nodup setting breaks DKIM & thus DMARC
by Ian Kelling 12 Jan '20

12 Jan '20

Public bug reported: Keeping DKIM signature intact allows passing DMARC without from munging (I have references all about this if needed). However, mailman modifies the cc header when a subscriber has the nodup setting and someone sends to the list with that subscriber cced. Mailman doesn't email them and removes them from the cc, presumably so for further replies mailman can email them without it being a duplicate and they get all the good mailman headers instead of a plain email from the cc. Anyways, best if Mailman just not modify the cc if we are in the situation where it matters for passing DMARC. The attached patch does that. Note, I'm sending this as an employee of the Free Software Foundation and my copyright is already going to them. ** Affects: mailman Importance: Undecided Status: New ** Patch added: "nodup-dkim.patch" https://bugs.launchpad.net/bugs/1845751/+attachment/5292024/+files/nodup-dk… -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1845751 Title: cc modification due to nodup setting breaks DKIM & thus DMARC To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1845751/+subscriptions

4 10