Skip to content
OpenAdvisories
Unscored DSA-4991-1 4 CVEs

mailman - security update

Published Oct 22, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 10 mailman 1:2.1.29-1+deb10u2

Vulnerabilities 4

  • Unscored —
    CVE-2020-12108

    /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection.

    mailman Ubuntu
  • Unscored —
    CVE-2020-15011

    GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page.

    mailman Ubuntu
  • Unscored —
    CVE-2021-42096

    GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin p…

    mailman Ubuntu
  • Unscored —
    CVE-2021-42097

    GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user ac…

    mailman Ubuntu