Debian Security Advisory
DSA-4991-1 mailman -- security update
- Date Reported:
- 22 Oct 2021
- Affected Packages:
- mailman
- Vulnerable:
- Yes
- Security database references:
- In Mitre's CVE dictionary: CVE-2020-12108, CVE-2020-15011, CVE-2021-42096, CVE-2021-42097.
- More information:
-
Several vulnerabilities were discovered in mailman, a web-based mailing list manager, which could result in arbitrary content injection via the options and private archive login pages, and CSRF attacks or privilege escalation via the user options page.
For the oldstable distribution (buster), these problems have been fixed in version 1:2.1.29-1+deb10u2.
We recommend that you upgrade your mailman packages.
For the detailed security status of mailman please refer to its security tracker page at: https://security-tracker.debian.org/tracker/mailman