Mailman 3 October 2021 - Mailman-coders

[Bug 1947639] [NEW] Potential Privilege escalation via the user options page.
by Mark Sapiro 19 Oct '21

19 Oct '21

*** This bug is a security vulnerability *** Private security bug reported: The `csrf_token` generated for the `options` page is always an `admin` token rather than specific to the authenticated user for that session. This admin token contains information that is derived from the hashed list admin password, which could theoretically allow a brute-force attack to obtain the list admin password. Thanks to Andre Protas, Richard Cloke and Andy Nuttall of Apple for reporting these and helping with the development of a fix. ** Affects: mailman Importance: Medium Assignee: Mark Sapiro (msapiro) Status: In Progress ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-42096 ** Summary changed: - Potential Privilege escallation via the user options page. + Potential Privilege escalation via the user options page. -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1947639 Title: Potential Privilege escalation via the user options page. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1947639/+subscriptions

2 3

[Bug 1947640] [NEW] Potential CSRF attack via the user options page.
by Mark Sapiro 19 Oct '21

19 Oct '21

*** This bug is a security vulnerability *** Private security bug reported: A valid `csrf_token` generated for one user session can be considered valid for another user session. This allows an attacker to generate a token which they can engineer another user, with an active session, to send to the server to execute the commands specified by the attacker whilst authenticated as the victim. Theoretically this could allow account take over. Thanks to Andre Protas, Richard Cloke and Andy Nuttall of Apple for reporting these and helping with the development of a fix. ** Affects: mailman Importance: Medium Assignee: Mark Sapiro (msapiro) Status: In Progress ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-42097 -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1947640 Title: Potential CSRF attack via the user options page. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1947640/+subscriptions

2 3

[Merge] lp:~futatuki/mailman/2.1-ja-translation into lp:mailman/2.1
by mp+410251＠code.launchpad.net 14 Oct '21

14 Oct '21

The content of this message was lost. It was probably cross-posted to multiple lists and previously handled on another list.

1 0

[Bug 1946272] [NEW] make find_member support --moderators option (patch supplied)
by James Ralston 12 Oct '21

12 Oct '21

Public bug reported: We run many, many mailing lists via Mailman 2.1, because we are a Red Hat Enterprise Linux shop and Red Hat ships Mailman 2.1 for all current versions of RHEL. Whenever a user leaves our organization, we need the ability to identify all lists for which the user was a subscriber, owner, or moderator, and take appropriate action (e.g., remove the user as a subscriber, or transfer ownership of the list to another individual). The find_member program is helpful in searching lists, but as shipped it does not have the ability to search for target email addresses as list moderators. This is functionality we need, and we do not know any other way to obtain that information. So, we added a --moderators option to find_members. We've been using this patch locally literally for years. We would like Red Hat to accept this patch in their Mailman 2.1 packages for RHEL8, but Red Hat has a fairly strict policy of not patching software they package for RHEL unless upstream has accepted the patch. We don't care if this patch ever makes it into a Mailman 2.1.XX release, but would you please accept the patch, so that we can then ask Red Hat to include it in their Mailman 2.1 packages that they ship for RHEL8? Thank you for your consideration. ** Affects: mailman Importance: Undecided Status: New ** Patch added: "patch for find_member to take --moderators option" https://bugs.launchpad.net/bugs/1946272/+attachment/5531145/+files/mailman-… -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1946272 Title: make find_member support --moderators option (patch supplied) To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1946272/+subscriptions

2 3