Skip to content
OpenAdvisories
High USN-5180-1 1 CVE

mailman vulnerability

Published Dec 7, 2021 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Mailman incorrectly handled CSRF tokens. A remote
list member or moderator could possibly use their own token to craft an
admin request CSRF attack and set a new admin password or make other
changes.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS mailman 1:2.1.26-1ubuntu0.6

Vulnerabilities 1

  • High 8.8
    CVE-2021-44227

    Cross Site Request Forgery in mailman

    In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.

    mailman mailman Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2021-44227