-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 08 Jun 2022 20:24:24 +0200 Source: mailman Binary: mailman Architecture: source Version: 1:2.1.23-1+deb9u8 Distribution: stretch-security Urgency: high Maintainer: Mailman for Debian <pkg-mailman-hackers@lists.alioth.debian.org> Changed-By: Sylvain Beucler <beuc@debian.org> Description: mailman - Powerful, web-based mailing list manager Closes: 1000367 1001685 Changes: mailman (1:2.1.23-1+deb9u8) stretch-security; urgency=high . * Non-maintainer upload by the LTS Security Team. * CVE-2021-43331: a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS. (Closes: #1000367) * CVE-2021-43332: the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack. (Closes: #1000367) * CVE-2021-44227: a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes. (Closes: #1001685) * CVE-2021-44227 and CVE 2021-42097 regression fix. (Closes: #1001685) Checksums-Sha1: c87e046651f46c02019a5c7227288ab16508e5ff 2153 mailman_2.1.23-1+deb9u8.dsc 48363f10106b6c5d2fda7e2421cbe7a8e5420675 108200 mailman_2.1.23-1+deb9u8.debian.tar.xz 96e3abaf158db7c714388a981514dfd0f9f5be4e 6581 mailman_2.1.23-1+deb9u8_amd64.buildinfo Checksums-Sha256: c13e76a3b2ef36041dd53b093db8528e1a162f89de02a35d5412cc29f232ba9c 2153 mailman_2.1.23-1+deb9u8.dsc f9b179a8eea970c6ae7aa5ffc77978af8f8925fcba06817943b3b062ddf3fbc2 108200 mailman_2.1.23-1+deb9u8.debian.tar.xz 40efdbab14a52c563e9be46286783e03ba4cc3a554177b27b5c5ce6dd04e36bf 6581 mailman_2.1.23-1+deb9u8_amd64.buildinfo Files: 36bf87e916fa879f9a8b025c3209379d 2153 mail optional mailman_2.1.23-1+deb9u8.dsc 63a67dc99bf8a5de00c1b049be57f807 108200 mail optional mailman_2.1.23-1+deb9u8.debian.tar.xz f30256b59b15c82bad79862ed0e0bb37 6581 mail optional mailman_2.1.23-1+deb9u8_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmKhtboACgkQDTl9HeUl XjBzghAAnrLLhnwrJx05rJHYO8bE6RO/PS4xjdMcIdG442mCN0mW/ijjVF/Wbow6 S7X35wSPKRNJoksAdnNKe2DqxWjs1U+KGl/hrSngVOpimtxwSRToO9NMdDloFTaR 4NFcUAgKDxWXSJqAvDbMJvxqafGQrSxMUDsT6M8MMyTuMbyIHf4/QslTAhIgsO25 U5xiwl1q4bYGXkH/3vDZOfJXyrZawbPE3JOwlRzt37A4f3/b8RydUibSl8mhWxax TaHUiieTONig7IL0wmAUrAmm1LWLODZ6SLeCc499HM6M2I4d0d5kRAizrn5fitQ0 7tE0slFNtqyXxCmw2/NIJ/aZOK5u3Frgho568QMldMTcX2XCoAXrLbNlsPa417mg 7wyTPL6sWqYACboQdpLtvd2Oay5+6dW/BSM4u5aBaDzHzFZlZgtze53A6BHYtMgY 62iLSKjbmWYoCd6G+XYHdt7nWJV94jj1o4wYjR2qmKmbKl1rIzgXBgQjwvz/18tk VqZbkvYGQkIV89I0GzIkWIwj++VH1RB2OAk2jBVZmqrut5TGATDD8jTFK4IRPMVb DW3h4ubXFivUVXRrQPblUGRZvwQ+ezvqvo4bX7Vj8aeuX4b3ysMCPzOgCACe4W4I rGz4pvsBcAoCPB7XtdPb8UvItMykHK7a63rImlDVlWaMrRF1D7c= =8ciM -----END PGP SIGNATURE-----
