RedHat: RHSA-2021-4913:04 Important: mailman security update | Linu...

Advisories

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: mailman security update
Advisory ID:       RHSA-2021:4913-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:4913
Issue date:        2021-12-02
CVE Names:         CVE-2016-6893 CVE-2021-42097 CVE-2021-44227 
=====================================================================

1. Summary:

An update for mailman is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - x86_64

3. Description:

Mailman is a program used to help manage e-mail discussion lists.

Security Fix(es):

* mailman: CSRF token bypass allows to perform CSRF attacks and account
takeover (CVE-2021-42097)

* mailman: CSRF token bypass allows to perform CSRF attacks and admin
takeover (CVE-2021-44227)

* mailman: CSRF protection missing in the user options page (CVE-2016-6893)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1370155 - CVE-2016-6893 mailman: CSRF protection missing in the user options page
2020568 - CVE-2021-42097 mailman: CSRF token bypass allows to perform CSRF attacks and account takeover
2026862 - CVE-2021-44227 mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover

6. Package List:

Red Hat Enterprise Linux Server (v. 7):

Source:
mailman-2.1.15-30.el7_9.2.src.rpm

ppc64:
mailman-2.1.15-30.el7_9.2.ppc64.rpm
mailman-debuginfo-2.1.15-30.el7_9.2.ppc64.rpm

ppc64le:
mailman-2.1.15-30.el7_9.2.ppc64le.rpm
mailman-debuginfo-2.1.15-30.el7_9.2.ppc64le.rpm

s390x:
mailman-2.1.15-30.el7_9.2.s390x.rpm
mailman-debuginfo-2.1.15-30.el7_9.2.s390x.rpm

x86_64:
mailman-2.1.15-30.el7_9.2.x86_64.rpm
mailman-debuginfo-2.1.15-30.el7_9.2.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
mailman-2.1.15-30.el7_9.2.src.rpm

x86_64:
mailman-2.1.15-30.el7_9.2.x86_64.rpm
mailman-debuginfo-2.1.15-30.el7_9.2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2016-6893
https://access.redhat.com/security/cve/CVE-2021-42097
https://access.redhat.com/security/cve/CVE-2021-44227
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYakv19zjgjWX9erEAQiEdBAAplbfwttVm3BO1wu4RvR70KWh6bHNCG4o
jx0OpF6BPq85FUCjc2o+NGFwiZGLO2cCs4p3zPDIvzT28VqIGg2n8KD1CGquAME7
M11TTGHhnqA9AZwIeTCEJ0ay6qjj/XTawjSGse9BEqlKlZ3BXpPiGz/4biOL4njV
aCcupNdYU26K8XRzMhBv32+4t7mO4YmaX+RHKXNRXKBKsWujuxM63MZ/fwr/ZfnZ
jBmmCjxMkskjqzNcX6NieK9OzFqbkvVmc10jeo31fJFz0kfif7nNj8dXi2OO9XYc
2XfP2OCh73X14LLFYkmF0F1Nsjo0W0gJpDLIFGSsyhu6nl2Q2Lann7GxUyrytvN3
NrB3MvALCojfsmsRrlWcc/MuIb0jgwPR5untJqUjkNCSjoW+9es+EE53n0JeftT3
6VGfiB9swdd/3WX+VX5sk+EtYqBrf+IDY+dvggGYqRkniqpAjpES1OGI8ecEZ6FG
cvS0dlzjvhUShnbpV7/4at8jYdx9oZ3Kkoiq9kulx/qsWkmAwXsKSjzg/2jO+wuu
alXahvuQIdWBlp5Y4UGsG6CnMJzPfG6yDGJHHj9rjX2FOmuepMeFBYtKBazhCq1s
u4JbrzRKqk0ZCDUZuuB2pt76Sn6BkL+J9bu5EH1UV3fUob2botWBSTqrQtmT7N3T
vKqFDbgZPGs=
=qEWu
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2021-4913:04 Important: mailman security update

An update for mailman is now available for Red Hat Enterprise Linux 7

Summary

Mailman is a program used to help manage e-mail discussion lists.
Security Fix(es):
* mailman: CSRF token bypass allows to perform CSRF attacks and account takeover (CVE-2021-42097)
* mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover (CVE-2021-44227)
* mailman: CSRF protection missing in the user options page (CVE-2016-6893)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changesdescribed in this advisory, refer to:https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2016-6893 https://access.redhat.com/security/cve/CVE-2021-42097 https://access.redhat.com/security/cve/CVE-2021-44227 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Enterprise Linux Server (v. 7):
Source: mailman-2.1.15-30.el7_9.2.src.rpm
ppc64: mailman-2.1.15-30.el7_9.2.ppc64.rpm mailman-debuginfo-2.1.15-30.el7_9.2.ppc64.rpm
ppc64le: mailman-2.1.15-30.el7_9.2.ppc64le.rpm mailman-debuginfo-2.1.15-30.el7_9.2.ppc64le.rpm
s390x: mailman-2.1.15-30.el7_9.2.s390x.rpm mailman-debuginfo-2.1.15-30.el7_9.2.s390x.rpm
x86_64: mailman-2.1.15-30.el7_9.2.x86_64.rpm mailman-debuginfo-2.1.15-30.el7_9.2.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source: mailman-2.1.15-30.el7_9.2.src.rpm
x86_64: mailman-2.1.15-30.el7_9.2.x86_64.rpm mailman-debuginfo-2.1.15-30.el7_9.2.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity
Advisory ID: RHSA-2021:4913-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:4913
Issued Date: : 2021-12-02
CVE Names: CVE-2016-6893 CVE-2021-42097 CVE-2021-44227

Topic

An update for mailman is now available for Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Relevant Releases Architectures

Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Workstation (v. 7) - x86_64

Bugs Fixed

1370155 - CVE-2016-6893 mailman: CSRF protection missing in the user options page

2020568 - CVE-2021-42097 mailman: CSRF token bypass allows to perform CSRF attacks and account takeover

2026862 - CVE-2021-44227 mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.