5
CVSSv2

CVE-2005-0202

Published: 02/05/2005 Updated: 11/10/2017
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Summary

Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and previous versions allows remote malicious users to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences.

Vulnerable Product Search on Vulmon Subscribe to Product

gnu mailman 2.1.4

gnu mailman 2.1.5

gnu mailman 2.1b1

gnu mailman 2.1.2

gnu mailman 2.1.3

gnu mailman 2.1

gnu mailman 2.1.1

Vendor Advisories

Synopsis mailman security update Type/Severity Security Advisory: Important Topic Updated mailman packages that correct a mailman security issue are nowavailable Description The mailman package is software to help manage email discussion listsA flaw in the true_path function of Mailman wa ...
Synopsis mailman security update Type/Severity Security Advisory: Important Topic Updated mailman packages to correct a security issue are nowavailable for Red Hat Enterprise Linux 4This update has been rated as having important security impact by the RedHat Security Response Team Description ...
An path traversal vulnerability has been discovered in the “private” module of Mailman A flawed path sanitation algorithm allowed the construction of URLS to arbitrary files readable by Mailman This allowed a remote attacker to retrieve configuration and password databases, private list archives, and other files ...
Ubuntu Security Announce USN-78-1 described a path traversal vulnerability in the “private” module of Mailman Unfortunately this updated mailman package was broken so that the “private” module could not be executed at all any more The latest package version fixes this ...
Due to an incompatibility between Python 15 and 21 the last mailman update did not run with Python 15 anymore This problem is corrected with this update This advisory only updates the packages updated with DSA 674-2 The version in unstable is not affected since it is not supposed to work with Python 15 anymore For completeness below is the ...