Skip to content
OpenAdvisories
High ELSA-2021-4913 3 CVEs

Important: mailman security update (Oracle Linux 7)

Published Dec 3, 2021 · Updated Dec 3, 2021

Ecosystem: Oracle Linux

Summary

[3:2.1.15-30.2]
- Fix for CVE-2021-44227
- Resolves: #2026866

[3:2.1.15-30.1]
- Fix for CVE-2016-6893
- Fix for CVE-2021-42097
- Resolves: #2024884, #2020688

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 7 mailman 3:2.1.15-30.el7_9.2

Vulnerabilities 3

  • High 8.8
    CVE-2021-44227

    Cross Site Request Forgery in mailman

    In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.

    mailman mailman Ubuntu PyPI
  • Unscored —
    CVE-2016-6893

    Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remo…

    mailman Ubuntu
  • Unscored —
    CVE-2021-42097

    GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user ac…

    mailman Ubuntu