Skip to content
OpenAdvisories
Medium ALAS2-2023-2370 2 CVEs

Moderate: mailman security update (Amazon Linux 2)

Published Nov 29, 2023 · Updated Dec 4, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-43332: In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack. CVE-2021-43331: In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 mailman 3:2.1.15-30.amzn2.2.1
Amazon Linux · 2 mailman-debuginfo 3:2.1.15-30.amzn2.2.1

Vulnerabilities 2

  • Unscored —
    CVE-2021-43331

    In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript fo…

    mailman Ubuntu
  • Unscored —
    CVE-2021-43332

    In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the l…

    mailman Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-43331.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-43332.html