Skip to content
OpenAdvisories
High RLSA-2021:4826 2 CVEs

Important: mailman:2.1 security update

Published Nov 23, 2021 · Updated Feb 5, 2026

Ecosystem: Rocky Linux

Summary

Mailman is a program used to help manage e-mail discussion lists.

Security Fix(es):

* mailman: CSRF token bypass allows to perform CSRF attacks and account takeover (CVE-2021-42097)

* mailman: CSRF token derived from admin password allows offline brute-force attack (CVE-2021-42096)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
Rocky Linux · 8 mailman 3:2.1.29-12.module+el8.5.0+717+27fd1ba7.2
Rocky Linux · 8 mailman 3:2.1.29-12.module+el8.5.0+703+19300c10

Vulnerabilities 2

  • Unscored —
    CVE-2021-42096

    GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin p…

    mailman Ubuntu
  • Unscored —
    CVE-2021-42097

    GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user ac…

    mailman Ubuntu

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2020568
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2020575