openSUSE Leap 15.0: 2018:1858-1 Moderate: Mailman Script Injection

This update for mailman to version 2.1.27 fixes the following issues:

This security issue was fixed:

- CVE-2018-0618: Additional protections against injecting scripts into

listinfo and error messages pages (bsc#1099510).

These non-security issues were fixed:

- The hash generated when SUBSCRIBE_FORM_SECRET is set could have been the

same as one generated at the same time for a different list and IP

address.

- An option has been added to bin/add_members to issue invitations instead

of immediately adding members.

- A new BLOCK_SPAMHAUS_LISTED_IP_SUBSCRIBE setting has been added to

enable blocking web subscribes from IPv4 addresses listed in Spamhaus

SBL, CSS or XBL. It will work with IPv6 addresses if Python's

py2-ipaddress module is installed. The module can be installed via pip

if not included in your Python.

- Mailman has a new 'security' log and logs authentication failures to the

various web CGI functions. ...