All errata/p10/ALT-PU-2024-7639-4
ALT-PU-2024-7639-4

Package update mailman in branch p10

Version2.1.39-alt1
Task#347760
Published2026-02-04
Max severityHIGH
Severity:

Closed issues (4)

BDU:2022-00592
MEDIUM6.1

Уязвимость пакета управления рассылками электронных писем GNU Mailman, связанная с недостаточной проверкой источника HTTP-запроса, позволяющая нарушителю выполнять атаки с подделкой межсайтовых запросов

Published: 2022-02-04
CVSS 3.xMEDIUM 6.1
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0MEDIUM 6.4
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N
References
CVE-2021-42097
HIGH8.0

GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).

Published: 2021-10-21Modified: 2024-11-21
CVSS 2.0HIGH 8.5
CVSS:2.0/AV:N/AC:M/Au:S/C:C/I:C/A:C
CVSS 3.xHIGH 8.0
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
References
CVE-2021-44227
HIGH8.8

In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.

Published: 2021-12-02Modified: 2024-11-21
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References