Skip to content
OpenAdvisories
Medium ALAS2-2018-985 1 CVE

Moderate: mailman security update (Amazon Linux 2)

Published Apr 5, 2018 · Updated Apr 5, 2018

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-5950: A cross-site scripting (XSS) flaw was found in mailman. An attacker, able to trick the user into visiting a specific URL, can execute arbitrary web scripts on the user's side and force the victim to perform unintended actions. 1537941: CVE-2018-5950 mailman: Cross-site scripting (XSS) vulnerability in web UI

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 mailman 3:2.1.15-26.amzn2.1
Amazon Linux · 2 mailman-debuginfo 3:2.1.15-26.amzn2.1

Vulnerabilities 1

  • Unscored —
    CVE-2018-5950

    Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbit…

    mailman Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-5950.html