Mailman-coders April 2023

Download

mailman-coders@python.org

2 participants
2 discussions

[Bug 2017813] [NEW] Membership information leak through options page.
by Mark Sapiro 22 May '23

22 May '23

*** This bug is a security vulnerability *** Private security bug reported: The fix for #2015416 was incomplete. The options login page returned from an invalid login with private rosters is still subtly different between the `email is not a list member` and the `email is a list member but password is incorrect` cases. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/2017813 Title: Membership information leak through options page. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/2017813/+subscriptions

2 4

[Bug 2015416] [NEW] Membership information leak through options page.
by Mark Sapiro 05 Apr '23

05 Apr '23

*** This bug is a security vulnerability *** Private security bug reported: This is similar to but different from #1968443. The issue is on a list with private rosters an attempt to log in to the options page with an email address which is not a list member just returns the options login page with no error, but attempt to login with an email address which is a list member returns the page with a 401 status and an `Authentication failed.` error message. This could be used to fish for membership on a list with private rosters. ** Affects: mailman Importance: Undecided Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/2015416 Title: Membership information leak through options page. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/2015416/+subscriptions

2 2