[Bug 1954694] [NEW] CSRF check for user tokens should not be case sensitive.

Public bug reported: The fix for CVE-2021-42097 requires that the user submitting a user options form match the user in the CSRF token submitted with the form, but the match is case sensitive and should not be. There is also a potential NameError exception in logging a mismatch. ** Affects: mailman Importance: Medium Assignee: Mark Sapiro (msapiro) Status: In Progress -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1954694 Title: CSRF check for user tokens should not be case sensitive. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1954694/+subscriptions

** Description changed: The fix for CVE-2021-42097 requires that the user submitting a user options form match the user in the CSRF token submitted with the form, but the match is case sensitive and should not be. + + There is also a potential NameError exception in logging a mismatch. -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1954694 Title: CSRF check for user tokens should not be case sensitive. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1954694/+subscriptions

** Attachment added: "Patch to fix this issue." https://bugs.launchpad.net/mailman/+bug/1954694/+attachment/5547352/+files/p... -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1954694 Title: CSRF check for user tokens should not be case sensitive. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1954694/+subscriptions

** Branch linked: lp:mailman/2.1 -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1954694 Title: CSRF check for user tokens should not be case sensitive. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1954694/+subscriptions

** Changed in: mailman Status: In Progress => Fix Released -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1954694 Title: CSRF check for user tokens should not be case sensitive. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1954694/+subscriptions

** Changed in: mailman Assignee: Mark Sapiro (msapiro) => Ant Phyo Hlyand Tun (antphyo) -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1954694 Title: CSRF check for user tokens should not be case sensitive. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1954694/+subscriptions

** Changed in: mailman Assignee: Ant Phyo Hlyand Tun (antphyo) => (unassigned) -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1954694 Title: CSRF check for user tokens should not be case sensitive. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1954694/+subscriptions

** Description changed: The fix for CVE-2021-42097 requires that the user submitting a user options form match the user in the CSRF token submitted with the form, but the match is case sensitive and should not be. + + There is also a potential NameError exception in logging a mismatch. -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1954694 Title: CSRF check for user tokens should not be case sensitive. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1954694/+subscriptions

** Attachment added: "Patch to fix this issue." https://bugs.launchpad.net/mailman/+bug/1954694/+attachment/5547352/+files/p... -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1954694 Title: CSRF check for user tokens should not be case sensitive. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1954694/+subscriptions

** Branch linked: lp:mailman/2.1 -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1954694 Title: CSRF check for user tokens should not be case sensitive. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1954694/+subscriptions

** Changed in: mailman Status: In Progress => Fix Released -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1954694 Title: CSRF check for user tokens should not be case sensitive. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1954694/+subscriptions

** Changed in: mailman Assignee: Mark Sapiro (msapiro) => Ant Phyo Hlyand Tun (antphyo) -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1954694 Title: CSRF check for user tokens should not be case sensitive. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1954694/+subscriptions

** Changed in: mailman Assignee: Ant Phyo Hlyand Tun (antphyo) => (unassigned) -- You received this bug notification because you are a member of Mailman Coders, which is subscribed to GNU Mailman. https://bugs.launchpad.net/bugs/1954694 Title: CSRF check for user tokens should not be case sensitive. To manage notifications about this bug go to: https://bugs.launchpad.net/mailman/+bug/1954694/+subscriptions
participants (3)
-
Ant Phyo Hlyand Tun
-
Launchpad Bug Tracker
-
Mark Sapiro