- ------------------------------------------------------------------------- Debian Security Advisory DSA-4991-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 22, 2021 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : mailman CVE ID : CVE-2020-12108 CVE-2020-15011 CVE-2021-42096 CVE-2021-42097 Several vulnerabilities were discovered in mailman, a web-based mailing list manager, which could result in arbitrary content injection via the options and private archive login pages, and CSRF attacks or privilege escalation via the user options page. For the oldstable distribution (buster), these problems have been fixed in version 1:2.1.29-1+deb10u2. We recommend that you upgrade your mailman packages. For the detailed security status of mailman please refer to its security tracker page at: https://security-tracker.debian.org/tracker/mailman Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: [email protected]