Skip to content
OpenAdvisories
Medium USN-4348-1 3 CVEs

mailman vulnerabilities

Published Apr 29, 2020 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Mailman incorrectly handled certain inputs.
An attacker could possibly use this to issue execute arbitrary scripts
or HTML. (CVE-2018-0618)

It was discovered that Mailman incorrectly handled certain inputs.
An attacker could possibly use this issue to display arbitrary text
on a web page. (CVE-2018-13796)

It was discovered that Mailman incorrectly handled certain files.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2020-12137)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS mailman 1:2.1.20-1ubuntu0.4
Ubuntu · 18.04 LTS 18.04:LTS mailman 1:2.1.26-1ubuntu0.1

Vulnerabilities 3

  • Medium 6.5
    CVE-2018-13796

    Moderate severity vulnerability that affects mailman

    An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site.

    mailman mailman Ubuntu PyPI
  • Unscored —
    CVE-2018-0618

    Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitr…

    GNU Mailman Mailman mailman Ubuntu
  • Unscored —
    CVE-2020-12137

    GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior m…

    mailman Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2018-0618
  • report
    https://ubuntu.com/security/CVE-2018-13796
  • report
    https://ubuntu.com/security/CVE-2020-12137