Mailman 3 June 2020 - Mailman-Users

What is character set of the log files?
by Brett Delmage 01 Jun '20

01 Jun '20

Hi! What is the character set coding for the log files, please? I'm using MM 2.1.29 I'm asking because a list admin want to view them via a web browser and I need to config Apache. Thanks. Brett

5 5

Insecure setup?
by Lucio 01 Jun '20

01 Jun '20

Until a few hours ago I was running mailman 2.1.29 on Debian Stretch, as packaged by Debian, e.g. mailman_1:2.1.29-1_amd64.deb, so I was missing the latest update published by Debian on April, 24 as mailman_1:2.1.29-1+deb10u1_amd64.deb. That means my mailman was vulnerable to this specific issue: https://security-tracker.debian.org/tracker/CVE-2020-12137 which is a XSS issue, and, as such, it can hardly be the cause of my problem. However I've now updated it nevertheless. A few hours ago I received a FBL complaint notification about a monthly subscription reminder marked as spam and actually coming from my server. The subscription reminder was attached to the FBL complaint, so I could see the mailman list subscribed email inside it, which is ada3167eb87301cb4835917425f07242(a)libero.it: it's clearly a fake email address or a real email address that's been created just for sending spam. The real user that raised the complaint is not shown for obvious privacy reasons, though I could discover it from the message id, but who cares, he's right after all, but by double checking the message id I could confirm the whole reminder is authentic and it actually went out of my mailserver. It is attached here, except I've masked my real domain name and my real server ip address. My mailman subscription logs (/var/log/mailman/subscribe*) go back one year and that fake email address does not appear in any of them, nor it is listed in the current subscribers list. It obviously does NOT match the email address of the user that received the spammed reminder and that raised the complaint. How did it happen? Is there a security flaw in my mailman setup? Where should I start looking at?

4 4

looking for just one command...
by Jeffrey Westgate 01 Jun '20

01 Jun '20

I am running v2.1.20, looking to upgrade to 2.1.32 (or 33), but the upgrade path seems to me to want the same options used in the previous install. I didn't do the previous install, so the one command I'm looking for is -- the one command that will tell me what options were used in the previous install. is there a command that will return the compile options of the previous install? is there a file that contains (maybe a list of) the compile options of the previous install? -- Jeff

3 2