Description
Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the Mailman server.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | mailman | < 2.1.5 | 2.1.5 | GHSA-hj4h-vqpq-95wg |
References
- 10412 vdb-entry
- GLSA-200406-04 vendor-advisory
- 11701 third-party-advisory
- mailman-obtain-password(16256) vdb-entry
- MDKSA-2004:051 vendor-advisory
- FEDORA-2004-1734 vendor-advisory
- CLA-2004:842 vendor-advisory
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=123559
- [Mailman-Announce] 20040515 RELEASED Mailman 2.1.5 mailing-list