Description
Cross-site scripting (XSS) vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | mailman | 2.0.11-1woody11 | DSA-674-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | mailman | 3:2.1.5-33.rhel4 | RHSA-2005:235 |
| RHEL 3 | mailman | 3:2.1.5-25.rhel3 | RHSA-2005:235 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | mailman | < 2.1.5 | 2.1.5 | GHSA-rh6c-jh4c-9fg3 |
Advisories 2
- RHSA-2005:235 Red Hat Security Advisory: mailman security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-674-1 mailman - cross-site scripting, directory traversal Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20050110 [USN-59-1] mailman vulnerabilities mailing-list
- mailman-script-driver-xss(18854) vdb-entry
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=287555
- 13603 third-party-advisory
- MDKSA-2005:015 vendor-advisory
- SUSE-SA:2005:007 vendor-advisory
- DSA-674 vendor-advisory
- RHSA-2005:235 vendor-advisory
- oval:org.mitre.oval:def:11113 vdb-entry signature