Summary
Mailman is a program used to help manage e-mail discussion lists.
Security Fix(es):
* mailman: CSRF token bypass allows to perform CSRF attacks and account takeover (CVE-2021-42097)
* mailman: CSRF token derived from admin password allows offline brute-force attack (CVE-2021-42096)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | mailman | 3:2.1.29-12.module_el8.5.0+26+48d4c9ee.2 |
| AlmaLinux · 8 | mailman | 3:2.1.29-12.module_el8.5.0+2601+e8845b76.1 |
| AlmaLinux · 8 | mailman | 3:2.1.29-12.module_el8.5.0+2602+327eb9f3.2 |
Vulnerabilities 2
-
Unscored —
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin p…
-
Unscored —
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user ac…