Mailman 3 November 2024 - Mailman-coders

[Bug 1968443] [NEW] Membership information leak through options page
by Evangelos Foutras May 18, 2026

May 18, 2026

Public bug reported: Using mailman 2.1.39 with the recent fixes for bug 1961762 applied on top. [1] [2] A user has noticed the following behavior on our list with private_roster = 1 (List members): [3] ========================== When using the Remind button: "If you are a list member, your password has been emailed to you." is only displayed when the entered email is on the list. The same thing happens with the Unsubscribe button, "If you are a list member, a confirmation email has been sent." is only displayed when the entered email is on the list. ========================== [1] https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1887 [2] https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1888 [3] https://bugs.archlinux.org/task/74424 ** Affects: mailman Importance: Undecided Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1968443 Title: Membership information leak through options page To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1968443/+subscriptions

4 4

[Bug 2015416] [NEW] Membership information leak through options page.
by Mark Sapiro May 18, 2026

May 18, 2026

*** This bug is a security vulnerability *** Private security bug reported: This is similar to but different from #1968443. The issue is on a list with private rosters an attempt to log in to the options page with an email address which is not a list member just returns the options login page with no error, but attempt to login with an email address which is a list member returns the page with a 401 status and an `Authentication failed.` error message. This could be used to fish for membership on a list with private rosters. ** Affects: mailman Importance: Undecided Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/2015416 Title: Membership information leak through options page. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/2015416/+subscriptions

4 5

[Bug 2017813] [NEW] Membership information leak through options page.
by Mark Sapiro May 18, 2026

May 18, 2026

*** This bug is a security vulnerability *** Private security bug reported: The fix for #2015416 was incomplete. The options login page returned from an invalid login with private rosters is still subtly different between the `email is not a list member` and the `email is a list member but password is incorrect` cases. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/2017813 Title: Membership information leak through options page. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/2017813/+subscriptions

3 5

[Bug 2088021] [NEW] pipermail archives Hungarian messages in wrong encoding
by Máté Gyöngyösi Nov. 12, 2024

Nov. 12, 2024

Public bug reported: Pipermail (Mailman 2.1.29) archives and/or shows some Hungarian messages in the wrong encoding. See https://lists.openstreetmap.org/pipermail/talk- hu/2021-October/016347.html for example: 'következő' is displayed like 'kďż˝vetkezďż˝' on macOS Safari 18.1 and Firefox 132.0.2. Monthly archives downloaded from https://lists.openstreetmap.org/pipermail/talk-hu/ (e.g. https://lists.openstreetmap.org/pipermail/talk-hu/2024-October.txt.gz ) also contain .txt files in ISO 8859-1 encoding which is not detected by macOS apps like BBEdit or TextEdit automatically. ** Affects: mailman Importance: Undecided Status: New ** Tags: 2.1.29 pipermail ** Summary changed: - pipermail archives messages in wrong encoding + pipermail archives Hungarian messages in wrong encoding ** Description changed: - Pipermail archives and/or shows some Hungarian messages in the wrong - encoding. See https://lists.openstreetmap.org/pipermail/talk- + Pipermail (Mailman 2.1.29) archives and/or shows some Hungarian messages + in the wrong encoding. See + https://lists.openstreetmap.org/pipermail/talk- hu/2021-October/016347.html for example: 'következő' is displayed like 'kďż˝vetkezďż˝' on macOS Safari 18.1 and Firefox 132.0.2. Monthly archives downloaded from https://lists.openstreetmap.org/pipermail/talk-hu/ (e.g. https://lists.openstreetmap.org/pipermail/talk-hu/2024-October.txt.gz ) also contain .txt files in ISO 8859-1 encoding which is not detected by macOS apps like BBEdit or TextEdit automatically. -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/2088021 Title: pipermail archives Hungarian messages in wrong encoding To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/2088021/+subscriptions

2 2