Upcoming Mailman 2.1 security release
A content injection vulnerability in Mailman 2.1 has been discovered and reported by Vishal Singh.
This is a heads-up that I plan to release Mailman 2.1.30-1 on Tuesday, May 5 to fix this issue. At that time I will also post details of the issue and a patch that can easily be applied to existing installations.
-- Mark Sapiro mark@msapiro.net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
I am pleased to announce the release of Mailman 2.1.31
Python 2.6 is the minimum supported, but Python 2.7, preferably 2.7.17 - the final Python 2 release, is strongly recommended.
This is a security fix release with an update to the Spanish translation and another couple of minor fixes. See the attached README.txt and the bug report at https://bugs.launchpad.net/mailman/+bug/1873722 for details.
For those who don't want to install the full update, the above bug report contains a simple patch to fix the security issue.
As noted Mailman 2.1.30 was the last feature release of the Mailman 2.1 branch from the GNU Mailman project. There has been some discussion as to what this means. It means there will be no more releases from the GNU Mailman project containing any new features. There may be future patch releases to address the following:
- i18n updates.
- security issues.
- bugs affecting operation for which no satisfactory workaround exists.
Mailman 2.1.31 is the first such patch release
Mailman is free software for managing email mailing lists and e-newsletters. Mailman is used for all the python.org and SourceForge.net mailing lists, as well as at hundreds of other sites.
For more information, please see our web site at one of:
http://www.list.org https://www.gnu.org/software/mailman http://mailman.sourceforge.net/
Mailman 2.1.31 can be downloaded from
https://launchpad.net/mailman/2.1/ https://ftp.gnu.org/gnu/mailman/ https://sourceforge.net/projects/mailman/
-- Mark Sapiro mark@msapiro.net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
On 5/5/20 9:01 AM, Mark Sapiro wrote:
Python 2.6 is the minimum supported, but Python 2.7, preferably 2.7.17 - the final Python 2 release, is strongly recommended.
It has been brought to my attention that the final Python 2 release is 2.7.18, released April 20, 2020, and that is what is recommended.
-- Mark Sapiro mark@msapiro.net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
Greetings,
I am the packager of Mailman 2.x for FreeBSD and am reporting two issues and have two questions:
I1: It would seem the Spanish translation has regressed with 2.1.31, and fails to build on FreeBSD 12.1:
/usr/local/bin/python2.7 ../build/bin/msgfmt.py -o es/LC_MESSAGES/mailman.mo es/LC_MESSAGES/mailman.po Traceback (most recent call last): File "../build/bin/msgfmt.py", line 203, in <module> main() File "../build/bin/msgfmt.py", line 199, in main make(filename, outfile) File "../build/bin/msgfmt.py", line 151, in make l = eval(l) File "<string>", line 1 " direcci�n de rebote cuando se usa "responder a todos"), as� que puede ser \n" ^ SyntaxError: invalid syntax *** Error code 1 (ignored)
There should be \" around 'responder a todos', not simple ". Future releases should test build the translations. (Am doing that in FreeBSD.)
I2: Then, none of the mailman.po files was updated for the security fix, and in FreeBSD, I am using sed for a machine edit, where WRKSRC is the directory that the code is unpacked into (including the mailman-2.1.* prefix/), and sed -E switches to modern regexps:
sed -E -e '/Illegal Email Address:/,+1s/ *. %\(safeuser\)s//'
${WRKSRC}/messages/*/LC_MESSAGES/mailman.po
Q1: how about the htdig patches? 1813 does not seem to be on par with 2.1.31. I am using the 2.1.30 patches (version 1812) for now.
Q2: Is the CVE from 2018 going to be used for this vuln or will there be a new CVE number assigned?
Thanks.
Regards, Matthias
On 5/5/20 11:09 AM, Matthias Andree wrote:
Greetings,
I am the packager of Mailman 2.x for FreeBSD and am reporting two issues and have two questions:
I1: It would seem the Spanish translation has regressed with 2.1.31, and fails to build on FreeBSD 12.1:
...
File "<string>", line 1 " direcci�n de rebote cuando se usa "responder a todos"), as� que puede ser \n" ^ SyntaxError: invalid syntax *** Error code 1 (ignored)
There should be \" around 'responder a todos', not simple ". Future releases should test build the translations. (Am doing that in FreeBSD.)
Thank you for the report. I actually did compile this message catalog, but with Mailman's bin/msgfmt.py which didn't catch this error.
I2: Then, none of the mailman.po files was updated for the security fix, and in FreeBSD, I am using sed for a machine edit, where WRKSRC is the directory that the code is unpacked into (including the mailman-2.1.* prefix/), and sed -E switches to modern regexps:
sed -E -e '/Illegal Email Address:/,+1s/ *. %\(safeuser\)s//'
${WRKSRC}/messages/*/LC_MESSAGES/mailman.po
My bad for not updating mailman.pot and making the subsequent changes.
I'm going to fix all the above and release 2.1.32 later today.
Q1: how about the htdig patches? 1813 does not seem to be on par with 2.1.31. I am using the 2.1.30 patches (version 1812) for now.
I'll get to it.
Q2: Is the CVE from 2018 going to be used for this vuln or will there be a new CVE number assigned?
The reporter told me he requested a CVE ID, but hasn't given it to me. I searched Mitre, but if there is a placeholder ID, I wouldn't find it anyway.
-- Mark Sapiro mark@msapiro.net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
There were some i18n issues in this morning's Mailman 2.1.31 release so I have released Mailman 2.1.32 to fix these.
Python 2.6 is the minimum supported, but Python 2.7, preferably 2.7.18 - the final Python 2 release, is strongly recommended.
Mailman 2.1.31 is a security fix release with an update to the Spanish translation and another couple of minor fixes. See the attached README.txt and the bug report at https://bugs.launchpad.net/mailman/+bug/1873722 for details.
For those who don't want to install the full update, the above bug report contains a simple patch to fix the security issue.
As noted Mailman 2.1.30 was the last feature release of the Mailman 2.1 branch from the GNU Mailman project. There has been some discussion as to what this means. It means there will be no more releases from the GNU Mailman project containing any new features. There may be future patch releases to address the following:
- i18n updates.
- security issues.
- bugs affecting operation for which no satisfactory workaround exists.
Mailman 2.1.31 is the first such patch release and Mailman 2.1.32 is the second.
Mailman is free software for managing email mailing lists and e-newsletters. Mailman is used for all the python.org and SourceForge.net mailing lists, as well as at hundreds of other sites.
For more information, please see our web site at one of:
http://www.list.org https://www.gnu.org/software/mailman http://mailman.sourceforge.net/
Mailman 2.1.32 can be downloaded from
https://launchpad.net/mailman/2.1/ https://ftp.gnu.org/gnu/mailman/ https://sourceforge.net/projects/mailman/
-- Mark Sapiro mark@msapiro.net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
Am 05.05.20 um 20:54 schrieb Mark Sapiro:
On 5/5/20 11:09 AM, Matthias Andree wrote:
Greetings,
I am the packager of Mailman 2.x for FreeBSD and am reporting two issues and have two questions:
I1: It would seem the Spanish translation has regressed with 2.1.31, and fails to build on FreeBSD 12.1:
...
File "<string>", line 1 " direcci�n de rebote cuando se usa "responder a todos"), as� que puede ser \n" ^ SyntaxError: invalid syntax *** Error code 1 (ignored) There should be \" around 'responder a todos', not simple ". Future releases should test build the translations. (Am doing that in FreeBSD.)
Thank you for the report. I actually did compile this message catalog, but with Mailman's bin/msgfmt.py which didn't catch this error.
Mark,
My build was also using Mailman's bin/msgfmt.py - it was using relative paths, I am pasting its failing command line again for your convenience:
/usr/local/bin/python2.7 ../build/bin/msgfmt.py -o es/LC_MESSAGES/mailman.mo es/LC_MESSAGES/mailman.po
I'm going to fix all the above and release 2.1.32 later today. (which I see is out) The reporter told me he requested a CVE ID, but hasn't given it to me. I searched Mitre, but if there is a placeholder ID, I wouldn't find it anyway.
Thank you. Found revision 1814.
Regards, Matthias
On 5/5/20 4:11 PM, Matthias Andree wrote:
My build was also using Mailman's bin/msgfmt.py - it was using relative paths, I am pasting its failing command line again for your convenience:
/usr/local/bin/python2.7 ../build/bin/msgfmt.py -o es/LC_MESSAGES/mailman.mo es/LC_MESSAGES/mailman.po
Yes, I see that I must have somehow just overlooked the error.
In any case, it's fixed now. Thanks again for reporting these things.
-- Mark Sapiro mark@msapiro.net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
participants (2)
-
Mark Sapiro -
Matthias Andree