Debian Security Advisory

DLA-3049-1 mailman -- LTS security update

Date Reported:
09 Jun 2022
Affected Packages:
mailman
Vulnerable:
Yes
Security database references:
In the Debian bugtracking system: Bug 1000367, Bug 1001685.
In Mitre's CVE dictionary: CVE-2021-43331, CVE-2021-43332, CVE-2021-44227.
More information:

Several vulnerabilities were discovered in Mailman, a web-based mailing list manager. An attacker could impersonate more privileged accounts through different vectors.

  • CVE-2021-43331

    A crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.

  • CVE-2021-43332

    The CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.

  • CVE-2021-44227

    A list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.

For Debian 9 stretch, these problems have been fixed in version 1:2.1.23-1+deb9u8.

We recommend that you upgrade your mailman packages.

For the detailed security status of mailman please refer to its security tracker page at: https://security-tracker.debian.org/tracker/mailman

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS