Mailman 3 June 2024 - Mailman-coders

[Bug 2047306] [NEW] Modify the calling domain of Google reCAPTCHA
by Gentry Deng 15 Nov '24

15 Nov '24

Public bug reported: Hello, I noticed that GNU Mailman uses Google reCAPTCHA for filtering bot traffic, unfortunately the default calling domain for Google reCAPTCHA is www.google.com. And www.google.com is inaccessible in some areas, such as the Chinese mainland. Google provides an alternative, they also provide reCAPTCHA access service at www.recaptcha.net. So can you modify the calling domain of Google reCAPTCHA to www.recaptcha.net? Google Developer Documentation: https://developers.google.com/recaptcha/docs/faq#can-i-use-recaptcha- globally Best regards, Gentry ** Affects: mailman Importance: Undecided Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/2047306 Title: Modify the calling domain of Google reCAPTCHA To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/2047306/+subscriptions

3 2

[Bug 2015416] [NEW] Membership information leak through options page.
by Mark Sapiro 11 Jul '24

11 Jul '24

*** This bug is a security vulnerability *** Private security bug reported: This is similar to but different from #1968443. The issue is on a list with private rosters an attempt to log in to the options page with an email address which is not a list member just returns the options login page with no error, but attempt to login with an email address which is a list member returns the page with a 401 status and an `Authentication failed.` error message. This could be used to fish for membership on a list with private rosters. ** Affects: mailman Importance: Undecided Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/2015416 Title: Membership information leak through options page. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/2015416/+subscriptions

3 4

[Bug 2071503] [NEW] Bug in Mailman version 2.1.39 We're sorry, we hit a bug! Please inform the webmaster for this site of this problem. Printing of traceback and other system information has been explicitly inhibited, but the webmaster can find this information in the Mailman error logs or the web server logs.
by Elizabeth Krone 28 Jun '24

28 Jun '24

Public bug reported: We have 4 discussion lists. I am not able to log into the main one and receive the following message: Bug in Mailman version 2.1.39 We're sorry, we hit a bug! Please inform the webmaster for this site of this problem. Printing of traceback and other system information has been explicitly inhibited, but the webmaster can find this information in the Mailman error logs or the web server logs. We do not have a webmaster for this site and I would like some guidance on how to resolve this. Thank you. ** Affects: mailman Importance: Undecided Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/2071503 Title: Bug in Mailman version 2.1.39 We're sorry, we hit a bug! Please inform the webmaster for this site of this problem. Printing of traceback and other system information has been explicitly inhibited, but the webmaster can find this information in the Mailman error logs or the web server logs. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/2071503/+subscriptions

2 1