Mailman 2.1.26 Security release Feb 4, 2018

An XSS vulnerability in the Mailman 2.1 web UI has been reported and assigned CVE-2018-5950 which is not yet public.
I plan to release Mailman 2.1.26 along with a patch for older releases to fix this issue on Feb 4, 2018. At that time, full details of the vulnerability will be public.
This is advance notice of the upcoming release and patch for those that need a week or two to prepare. The patch will be small and only affect one module.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

I am pleased to announce the release of Mailman 2.1.26.
Python 2.4 is the minimum supported, but Python 2.7 is strongly recommended.
This is a security and bug fix release with a couple of new features. See the attached README.txt for details.
For those who are concerned about the security vulnerability and can't upgrade immediately, there is a patch at <https://bugs.launchpad.net/mailman/+bug/1747209/+attachment/5048344/+files/o...> to fix the security issue. More information on the issue itself is in the bug report at <https://bugs.launchpad.net/mailman/+bug/1747209>.
Mailman is free software for managing email mailing lists and e-newsletters. Mailman is used for all the python.org and SourceForge.net mailing lists, as well as at hundreds of other sites.
For more information, please see our web site at one of:
http://www.list.org https://www.gnu.org/software/mailman http://mailman.sourceforge.net/ https://mirror.list.org/
Mailman 2.1.26 can be downloaded from
https://launchpad.net/mailman/2.1/ https://ftp.gnu.org/gnu/mailman/ https://sourceforge.net/projects/mailman/
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

Hi,
FWIW, I just installed 2.1.26 on a test system, and that command does not work for me:
$ mailman-config File "/usr/lib/mailman/bin/mailman-config", line 34 print "mail_group: %s" % ""mail", "postfix", "mailman", "nobody", "daemon"" ^ SyntaxError: invalid syntax
Both that line and the following (for cgi_group) are double-quoted:
print "cgi_group: %s" % ""apache""
If I remove the quotes in bin/mailman-config prior to running configure, the resulting script works fine:
print "mail_group: %s" % @MAIL_GROUP@ print "cgi_group: %s" % @CGI_GROUP@
$ build/bin/mailman-config Configuration and build information for Mailman
Mailman version: 2.1.26 Build Date: Wed Feb 7 12:58:18 CET 2018
prefix: /usr/local/mailman var_prefix: /usr/local/mailman mailman_user: mailman mailman_group: mailman mail_group: mailman other mail daemon cgi_group: www www-data nobody
configure_opts: "--with-python=/usr/bin/python2.7 --without-permcheck"
--On 4. Februar 2018 um 09:51:37 -0800 Mark Sapiro <mark@msapiro.net> wrote:
-- .:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:. .:.Regionales Rechenzentrum (RRZK).:. .:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.

On 02/07/2018 04:01 AM, Sebastian Hagedorn wrote:
The issue is you're running configure --without-permcheck and you haven't specified --with-mail-gid and --with-cgi-gid.
If you don't specify those, configure looks for an existing group for mail-gid from "mailman other mail daemon" and for cgi-gid from "www www-data nobody". If you don't specify --without-permcheck, configure complains if it doesn't find a group in the system from the list, but if you do specify --without-permcheck and configure doesn't find a group it uses the whole "mailman other mail daemon" and/or "www www-data nobody" string which causes the issue you're seeing in mailman-config.
There will also be group mismatch errors in the configured wrappers in this case.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

Hm, part of that was an artifact of running configure manually instead of using the SPEC file I usually use to build Mailman. With the latter and my "fix" I get the following:
$ mailman-config Configuration and build information for Mailman
Mailman version: 2.1.26 Build Date: Wed Feb 7 13:23:45 CET 2018
prefix: /usr/lib/mailman var_prefix: /var/lib/mailman mailman_user: mailman mailman_group: mailman mail_group: mail postfix mailman nobody daemon cgi_group: apache
configure_opts: "--prefix=/usr/lib/mailman --with-var-prefix=/var/lib/mailman --with-config-dir=/etc/mailman --with-lock-dir=/var/lock/mailman --with-log-dir=/var/log/mailman --with-pid-dir=/var/run/mailman --with-queue-dir=/var/spool/mailman --with-python=/usr/bin/python2.7 --with-mail-gid=mail postfix mailman nobody daemon --with-cgi-id=apache --with-cgi-gid=apache --with-mailhost=localhost.localdomain --with-urlhost=localhost.localdomain --without-permcheck"
So it's still using --without-permcheck, but the other options are there.
Sebastian Hagedorn - Weyertal 121, Zimmer 2.02 Regionales Rechenzentrum (RRZK) Universität zu Köln / Cologne University - Tel. +49-221-470-89578

On 02/07/2018 01:38 PM, Sebastian Hagedorn wrote:
When I run that command without having made any changes in the unpacked tarball on a machine without a 'mailman' user, but with a 'mail' group, I get this from configure
configure: WARNING: unrecognized options: --with-config-dir, --with-lock-dir, --with-log-dir, --with-pid-dir, --with-queue-dir, --with-cgi-id
This is expected because those options to configure were added by RedHat as part of their FHS compliance patch. See <https://wiki.list.org/x/8486953> and <https://mail.python.org/pipermail/mailman-developers/2004-October/017343.htm...>
I get this from the bin/mailman-config command
Configuration and build information for Mailman
Mailman version: 2.1.26 Build Date: Wed Feb 7 14:19:11 PST 2018
prefix: /usr/lib/mailman var_prefix: /var/lib/mailman mailman_user: mailman_group: mail_group: mail cgi_group: apache
configure_opts: "--prefix=/usr/lib/mailman --with-var-prefix=/var/lib/mailman --with-config-dir=/etc/mailman --with-lock-dir=/var/lock/mailman --with-log-dir=/var/log/mailman --with-pid-dir=/var/run/mailman --with-queue-dir=/var/spool/mailman --with-python=/usr/bin/python2.7 --with-mail-gid=mail postfix mailman nobody daemon --with-cgi-id=apache --with-cgi-gid=apache --with-mailhost=localhost.localdomain --with-urlhost=localhost.localdomain --without-permcheck"
The empty mailman_user and mailman_group is because there is no 'mailman' user/group on the system I ran it on and the fact that I get mail_group = 'mail' rather than 'mail postfix mailman nobody daemon' is because there is a 'mail' group (it picks the first group that exists from that list and only yields the whole list as the result if none exist.
I suspect that your actual configure command options rather than the ones reported by your bin/mailman-config are something like
--prefix=/usr/lib/mailman --with-var-prefix=/var/lib/mailman --with-config-dir=/etc/mailman --with-lock-dir=/var/lock/mailman --with-log-dir=/var/log/mailman --with-pid-dir=/var/run/mailman --with-queue-dir=/var/spool/mailman --with-python=/usr/bin/python2.7 --with-mail-gid='"mail postfix mailman nobody daemon"' --with-cgi-id=apache --with-cgi-gid=\"apache\" --with-mailhost=localhost.localdomain --with-urlhost=localhost.localdomain --without-permcheck
and that's where the extraneous quotes are coming from. I think the passing of a list to --with-mail-gid relies on another RedHat modification to the mail wrapper to be able to dynamically configure the mail group and not build it in to the RPM.
The question is what are you trying to do.
If you just want to build a working Mailman 2.1.26 installation, I suggest removing the --with-config-dir, --with-lock-dir, --with-log-dir, --with-pid-dir, --with-queue-dir, --with-cgi-id options and setting --with-mail-gid and --with-cgi-gid to the appropriate single groups without any quotes.
If you are trying to build a RHEL FHS compliant Mailman, start by porting the patch in the attachment to <https://mail.python.org/pipermail/mailman-developers/2004-October/017343.htm...> and applying it, running autoconf to regenerate configure from configure.in and take any resultant issues to RedHat. Note, the last I knew, John Dennis was still at RedHat, but was no longer working with Mailman, but that was a long time ago. In case it isn't obvious, I recommend the first approach.
If you're just trying to fix CVE-2018-5950, just apply the patch attached to <https://bugs.launchpad.net/mailman/+bug/1747209>.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

Thank you for this detailed analysis that goes far above and beyond what one can reasonably expect! I did not expect the issue to be caused by the patches specific to Red Hat, otherwise I wouldn't have bothered you with this.
--On 7. Februar 2018 um 15:22:24 -0800 Mark Sapiro <mark@msapiro.net> wrote:
Right, we've been using the Red Hat patches for many years. Even on RHEL 7 Red Hat only provides an RPM for 2.1.15, so at some point I took the SPEC file from their source RPM and have been updating it myself.
In our SPEC file it looks like this:
./configure
--prefix=%{mmdir}
--with-var-prefix=%{varmmdir}
--with-config-dir=%{configdir}
--with-lock-dir=%{lockdir}
--with-log-dir=%{logdir}
--with-pid-dir=%{piddir}
--with-queue-dir=%{queuedir}
--with-python=/usr/bin/python2.7
--with-mail-gid=%{mailgroup}
--with-cgi-id=%{cgiuser}
--with-cgi-gid=%{cgigroup}
--with-mailhost=localhost.localdomain
--with-urlhost=localhost.localdomain
--without-permcheck
The variables in question are defined like this:
# Now, the groups your mail spoolers run as. Sendmail uses 'mail'(12) # and postfix used to use 'nobody', but now uses 'postfix' %define mailgroup "mail postfix mailman nobody daemon"
# Now, the user and group the CGIs will expect to be run under. This should # match the user and group the web server is configured to run as. The scripts # will error out if they are invoked by any other user. %define cgiuser apache %define cgigroup apache
Which explains the quotes for mailgroup, although I don't understand where the quotes for cgigroup come from ...
That would be fine for a new installation but I'm wary of such a change on an active system. In hindsight we should never have used the RPMs provided by Red Hat in the first place.
That's what we're already doing.
and take any resultant issues to RedHat.
That part is useless, unfortunately.
As I mentioned I "fixed" this by removing the quotes around @MAIL_GROUP@ and @CGI_GROUP@. I have included that patch in our SPEC file with a note not to bother the community with that issue.
.:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:.
.:.Regionales Rechenzentrum (RRZK).:.
.:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.

I am pleased to announce the release of Mailman 2.1.26.
Python 2.4 is the minimum supported, but Python 2.7 is strongly recommended.
This is a security and bug fix release with a couple of new features. See the attached README.txt for details.
For those who are concerned about the security vulnerability and can't upgrade immediately, there is a patch at <https://bugs.launchpad.net/mailman/+bug/1747209/+attachment/5048344/+files/o...> to fix the security issue. More information on the issue itself is in the bug report at <https://bugs.launchpad.net/mailman/+bug/1747209>.
Mailman is free software for managing email mailing lists and e-newsletters. Mailman is used for all the python.org and SourceForge.net mailing lists, as well as at hundreds of other sites.
For more information, please see our web site at one of:
http://www.list.org https://www.gnu.org/software/mailman http://mailman.sourceforge.net/ https://mirror.list.org/
Mailman 2.1.26 can be downloaded from
https://launchpad.net/mailman/2.1/ https://ftp.gnu.org/gnu/mailman/ https://sourceforge.net/projects/mailman/
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

Hi,
FWIW, I just installed 2.1.26 on a test system, and that command does not work for me:
$ mailman-config File "/usr/lib/mailman/bin/mailman-config", line 34 print "mail_group: %s" % ""mail", "postfix", "mailman", "nobody", "daemon"" ^ SyntaxError: invalid syntax
Both that line and the following (for cgi_group) are double-quoted:
print "cgi_group: %s" % ""apache""
If I remove the quotes in bin/mailman-config prior to running configure, the resulting script works fine:
print "mail_group: %s" % @MAIL_GROUP@ print "cgi_group: %s" % @CGI_GROUP@
$ build/bin/mailman-config Configuration and build information for Mailman
Mailman version: 2.1.26 Build Date: Wed Feb 7 12:58:18 CET 2018
prefix: /usr/local/mailman var_prefix: /usr/local/mailman mailman_user: mailman mailman_group: mailman mail_group: mailman other mail daemon cgi_group: www www-data nobody
configure_opts: "--with-python=/usr/bin/python2.7 --without-permcheck"
--On 4. Februar 2018 um 09:51:37 -0800 Mark Sapiro <mark@msapiro.net> wrote:
-- .:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:. .:.Regionales Rechenzentrum (RRZK).:. .:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.

On 02/07/2018 04:01 AM, Sebastian Hagedorn wrote:
The issue is you're running configure --without-permcheck and you haven't specified --with-mail-gid and --with-cgi-gid.
If you don't specify those, configure looks for an existing group for mail-gid from "mailman other mail daemon" and for cgi-gid from "www www-data nobody". If you don't specify --without-permcheck, configure complains if it doesn't find a group in the system from the list, but if you do specify --without-permcheck and configure doesn't find a group it uses the whole "mailman other mail daemon" and/or "www www-data nobody" string which causes the issue you're seeing in mailman-config.
There will also be group mismatch errors in the configured wrappers in this case.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

Hm, part of that was an artifact of running configure manually instead of using the SPEC file I usually use to build Mailman. With the latter and my "fix" I get the following:
$ mailman-config Configuration and build information for Mailman
Mailman version: 2.1.26 Build Date: Wed Feb 7 13:23:45 CET 2018
prefix: /usr/lib/mailman var_prefix: /var/lib/mailman mailman_user: mailman mailman_group: mailman mail_group: mail postfix mailman nobody daemon cgi_group: apache
configure_opts: "--prefix=/usr/lib/mailman --with-var-prefix=/var/lib/mailman --with-config-dir=/etc/mailman --with-lock-dir=/var/lock/mailman --with-log-dir=/var/log/mailman --with-pid-dir=/var/run/mailman --with-queue-dir=/var/spool/mailman --with-python=/usr/bin/python2.7 --with-mail-gid=mail postfix mailman nobody daemon --with-cgi-id=apache --with-cgi-gid=apache --with-mailhost=localhost.localdomain --with-urlhost=localhost.localdomain --without-permcheck"
So it's still using --without-permcheck, but the other options are there.
Sebastian Hagedorn - Weyertal 121, Zimmer 2.02 Regionales Rechenzentrum (RRZK) Universität zu Köln / Cologne University - Tel. +49-221-470-89578

On 02/07/2018 01:38 PM, Sebastian Hagedorn wrote:
When I run that command without having made any changes in the unpacked tarball on a machine without a 'mailman' user, but with a 'mail' group, I get this from configure
configure: WARNING: unrecognized options: --with-config-dir, --with-lock-dir, --with-log-dir, --with-pid-dir, --with-queue-dir, --with-cgi-id
This is expected because those options to configure were added by RedHat as part of their FHS compliance patch. See <https://wiki.list.org/x/8486953> and <https://mail.python.org/pipermail/mailman-developers/2004-October/017343.htm...>
I get this from the bin/mailman-config command
Configuration and build information for Mailman
Mailman version: 2.1.26 Build Date: Wed Feb 7 14:19:11 PST 2018
prefix: /usr/lib/mailman var_prefix: /var/lib/mailman mailman_user: mailman_group: mail_group: mail cgi_group: apache
configure_opts: "--prefix=/usr/lib/mailman --with-var-prefix=/var/lib/mailman --with-config-dir=/etc/mailman --with-lock-dir=/var/lock/mailman --with-log-dir=/var/log/mailman --with-pid-dir=/var/run/mailman --with-queue-dir=/var/spool/mailman --with-python=/usr/bin/python2.7 --with-mail-gid=mail postfix mailman nobody daemon --with-cgi-id=apache --with-cgi-gid=apache --with-mailhost=localhost.localdomain --with-urlhost=localhost.localdomain --without-permcheck"
The empty mailman_user and mailman_group is because there is no 'mailman' user/group on the system I ran it on and the fact that I get mail_group = 'mail' rather than 'mail postfix mailman nobody daemon' is because there is a 'mail' group (it picks the first group that exists from that list and only yields the whole list as the result if none exist.
I suspect that your actual configure command options rather than the ones reported by your bin/mailman-config are something like
--prefix=/usr/lib/mailman --with-var-prefix=/var/lib/mailman --with-config-dir=/etc/mailman --with-lock-dir=/var/lock/mailman --with-log-dir=/var/log/mailman --with-pid-dir=/var/run/mailman --with-queue-dir=/var/spool/mailman --with-python=/usr/bin/python2.7 --with-mail-gid='"mail postfix mailman nobody daemon"' --with-cgi-id=apache --with-cgi-gid=\"apache\" --with-mailhost=localhost.localdomain --with-urlhost=localhost.localdomain --without-permcheck
and that's where the extraneous quotes are coming from. I think the passing of a list to --with-mail-gid relies on another RedHat modification to the mail wrapper to be able to dynamically configure the mail group and not build it in to the RPM.
The question is what are you trying to do.
If you just want to build a working Mailman 2.1.26 installation, I suggest removing the --with-config-dir, --with-lock-dir, --with-log-dir, --with-pid-dir, --with-queue-dir, --with-cgi-id options and setting --with-mail-gid and --with-cgi-gid to the appropriate single groups without any quotes.
If you are trying to build a RHEL FHS compliant Mailman, start by porting the patch in the attachment to <https://mail.python.org/pipermail/mailman-developers/2004-October/017343.htm...> and applying it, running autoconf to regenerate configure from configure.in and take any resultant issues to RedHat. Note, the last I knew, John Dennis was still at RedHat, but was no longer working with Mailman, but that was a long time ago. In case it isn't obvious, I recommend the first approach.
If you're just trying to fix CVE-2018-5950, just apply the patch attached to <https://bugs.launchpad.net/mailman/+bug/1747209>.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

Thank you for this detailed analysis that goes far above and beyond what one can reasonably expect! I did not expect the issue to be caused by the patches specific to Red Hat, otherwise I wouldn't have bothered you with this.
--On 7. Februar 2018 um 15:22:24 -0800 Mark Sapiro <mark@msapiro.net> wrote:
Right, we've been using the Red Hat patches for many years. Even on RHEL 7 Red Hat only provides an RPM for 2.1.15, so at some point I took the SPEC file from their source RPM and have been updating it myself.
In our SPEC file it looks like this:
./configure
--prefix=%{mmdir}
--with-var-prefix=%{varmmdir}
--with-config-dir=%{configdir}
--with-lock-dir=%{lockdir}
--with-log-dir=%{logdir}
--with-pid-dir=%{piddir}
--with-queue-dir=%{queuedir}
--with-python=/usr/bin/python2.7
--with-mail-gid=%{mailgroup}
--with-cgi-id=%{cgiuser}
--with-cgi-gid=%{cgigroup}
--with-mailhost=localhost.localdomain
--with-urlhost=localhost.localdomain
--without-permcheck
The variables in question are defined like this:
# Now, the groups your mail spoolers run as. Sendmail uses 'mail'(12) # and postfix used to use 'nobody', but now uses 'postfix' %define mailgroup "mail postfix mailman nobody daemon"
# Now, the user and group the CGIs will expect to be run under. This should # match the user and group the web server is configured to run as. The scripts # will error out if they are invoked by any other user. %define cgiuser apache %define cgigroup apache
Which explains the quotes for mailgroup, although I don't understand where the quotes for cgigroup come from ...
That would be fine for a new installation but I'm wary of such a change on an active system. In hindsight we should never have used the RPMs provided by Red Hat in the first place.
That's what we're already doing.
and take any resultant issues to RedHat.
That part is useless, unfortunately.
As I mentioned I "fixed" this by removing the quotes around @MAIL_GROUP@ and @CGI_GROUP@. I have included that patch in our SPEC file with a note not to bother the community with that issue.
.:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:.
.:.Regionales Rechenzentrum (RRZK).:.
.:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.
participants (2)
-
Mark Sapiro
-
Sebastian Hagedorn