mailman: CVE-2020-12137

Debian Bug report logs - #958930
mailman: CVE-2020-12137

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: mailman: CVE-2020-12137

Date: Sun, 26 Apr 2020 21:29:31 +0200

Source: mailman
Version: 1:2.1.29-1
Severity: grave
Tags: security upstream
Control: found -1 1:2.1.23-1+deb9u4
Control: found -1 1:2.1.23-1
Control: fixed -1 1:2.1.23-1+deb9u5
Control: fixed -1 1:2.1.29-1+deb10u1

Hi,

Note filling this mainly for tracking and for the "regression" from
stable. Given that, if no upload happens at point release time it
might just prop-up from stable to unstable and so include the fix as
well for bullseye.

The following vulnerability was published for mailman.

CVE-2020-12137[0]:
| GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed
| application/octet-stream MIME parts. This behavior may contribute to
| XSS attacks against list-archive visitors, because an HTTP reply from
| an archive web server may lack a MIME type, and a web browser may
| perform MIME sniffing, conclude that the MIME type should have been
| text/html, and execute JavaScript code.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-12137
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12137

Regards,
Salvatore

Send a report that this bug log contains spam.