Skip to content
OpenAdvisories
High DLA-3049-1 3 CVEs

mailman - security update

Published Jun 9, 2022 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 mailman 1:2.1.23-1+deb9u8

Vulnerabilities 3

  • High 8.8
    CVE-2021-44227

    Cross Site Request Forgery in mailman

    In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.

    mailman mailman Ubuntu PyPI
  • Unscored —
    CVE-2021-43331

    In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript fo…

    mailman Ubuntu
  • Unscored —
    CVE-2021-43332

    In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the l…

    mailman Ubuntu