Skip to content
OpenAdvisories
Unscored USN-5151-1 2 CVEs

mailman vulnerabilities

Published Nov 18, 2021 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Mailman incorrectly handled certain URL.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2021-43331)

It was discovered that Mailman incorrectly handled certain inputs.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2021-43332)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS mailman 1:2.1.26-1ubuntu0.5
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS mailman 1:2.1.20-1ubuntu0.6+esm2

Vulnerabilities 2

  • Unscored —
    CVE-2021-43331

    In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript fo…

    mailman Ubuntu
  • Unscored —
    CVE-2021-43332

    In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the l…

    mailman Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2021-43331
  • report
    https://ubuntu.com/security/CVE-2021-43332
  • report
    https://launchpad.net/bugs/1949401
  • report
    https://launchpad.net/mailman/+bug/1949403