Skip to content
OpenAdvisories
Medium ALAS2-2020-1536 2 CVEs

Moderate: mailman security update (Amazon Linux 2)

Published Oct 22, 2020 · Updated Oct 22, 2020

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-13796: An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site. 1609090: CVE-2018-13796 mailman: Mishandled URLs in Utils.py:GetPathPieces() allows attackers to display arbitrary text on trusted sites CVE-2018-0618: A cross-site scripting vulnerability (XSS) has been discovered in mailman due to the host_name field not being properly validated. A malicious list owner could use this flaw to create a specially crafted list and inject client-side scripts. 1596458: CVE-2018-0618 mailman: Cross-site scripting vulnerability allows malicious listowners to inject scripts into listinfo pages

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 mailman 3:2.1.15-30.amzn2
Amazon Linux · 2 mailman-debuginfo 3:2.1.15-30.amzn2

Vulnerabilities 2

  • Medium 6.5
    CVE-2018-13796

    Moderate severity vulnerability that affects mailman

    An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site.

    mailman mailman Ubuntu PyPI
  • Unscored —
    CVE-2018-0618

    Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitr…

    GNU Mailman Mailman mailman Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-0618.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-13796.html