[Bug 2017813] [NEW] Membership information leak through options page.
*** This bug is a security vulnerability *** Private security bug reported: The fix for #2015416 was incomplete. The options login page returned from an invalid login with private rosters is still subtly different between the `email is not a list member` and the `email is a list member but password is incorrect` cases. ** Affects: mailman Importance: Low Assignee: Mark Sapiro (msapiro) Status: New -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/2017813 Title: Membership information leak through options page. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/2017813/+subscriptions
The fix for this specific issue is simple. See https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1892 but it depends on other changes since the 2.1.39 release, a patch against that base is attached. ** Patch added: "Patch against the 2.1.39 base" https://bugs.launchpad.net/mailman/+bug/2017813/+attachment/5669009/+files/o... -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/2017813 Title: Membership information leak through options page. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/2017813/+subscriptions
** Branch linked: lp:mailman/2.1 -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/2017813 Title: Membership information leak through options page. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/2017813/+subscriptions
** Changed in: mailman Status: New => Fix Committed ** Information type changed from Private Security to Public -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/2017813 Title: Membership information leak through options page. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/2017813/+subscriptions
The prior fix for this issue at https://bazaar.launchpad.net/~mailman- coders/mailman/2.1/revision/1892 created another possible leak. This has been corrected at https://bazaar.launchpad.net/~mailman- coders/mailman/2.1/revision/1893 and an updated patch against the 2.1.39 base is attached. ** Patch added: "Updated patch against 2.1.39 base" https://bugs.launchpad.net/mailman/+bug/2017813/+attachment/5674724/+files/2... -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/2017813 Title: Membership information leak through options page. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/2017813/+subscriptions
participants (2)
-
Launchpad Bug Tracker -
Mark Sapiro