Summary
It was discovered that Mailman incorrectly handled CSRF tokens. A remote
list member or moderator could possibly use their own token to craft an
admin request CSRF attack and set a new admin password or make other
changes.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | mailman | 1:2.1.20-1ubuntu0.6+esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | mailman | 1:2.1.29-1ubuntu3.1+esm2 |
References
-
report
https://ubuntu.com/security/CVE-2021-44227