Debian Security Advisory
DLA-3049-1 mailman -- LTS security update
- Date Reported:
- 09 Jun 2022
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 1000367, Bug 1001685.
In Mitre's CVE dictionary: CVE-2021-43331, CVE-2021-43332, CVE-2021-44227.
- More information:
Several vulnerabilities were discovered in Mailman, a web-based mailing list manager. An attacker could impersonate more privileged accounts through different vectors.
The CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.
A list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.
For Debian 9 stretch, these problems have been fixed in version 1:2.1.23-1+deb9u8.
We recommend that you upgrade your mailman packages.
For the detailed security status of mailman please refer to its security tracker page at: https://security-tracker.debian.org/tracker/mailman
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS