Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 517
Alerts This Week
Warning Icon 1 517

Ubuntu 20.04 LTS: USN-5121-2 Critical Mailman CSRF Attack Fix

ubuntu
Calendar Grey November 1, 2021
Dist Ubuntu Esm H88
Mailman security issues addressed in Ubuntu 20.04 LTS. The patches resolve problems related to content manipulation and CSRF vulnerabilities.
Several security issues were fixed in Mailman.

Summary

Several security issues were fixed in Mailman.

Software Description:

- mailman: Web-based mailing list manager

Details:

USN-5009-1 fixed vulnerabilities in Mailman. This update provides the

corresponding updates for Ubuntu 20.04 LTS. In addition, the following CVEs

were fixed:

It was discovered that Mailman allows arbitrary content injection. An attacker

could use this to inject malicious content. (CVE-2020-12108, CVE-2020-15011)

It was discovered that Mailman improperly sanitize the MIME content. An

attacker could obtain sensitive information by sending a special type of

attachment. (CVE-2020-12137)

Original advisory details:

Andre Protas, Richard Cloke, and Andy Nuttall discovered that Mailman

did not properly associate cross-site request forgery (CSRF) tokens

to specific accounts. A remote attacker could use this to perform a

CSRF attack to gain access to another account. (CVE-2021-42097)

Andre Protas, Richard Cloke, and Andy Nuttall discovere...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory critical email service ubuntu mailman CSRF content injection

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
  mailman                         1:2.1.29-1ubuntu3.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-5121-2

https://ubuntu.com/security/notices/USN-5121-1

CVE-2020-12108, CVE-2020-12137, CVE-2020-15011, CVE-2021-42096,

CVE-2021-42097

Severity
critical
Lowest
Low
Medium
High
Critical

November 01, 2021

Topics%20covered

Topics Covered

security advisory critical email service ubuntu mailman CSRF content injection

Package Information

https://launchpad.net/ubuntu/+source/mailman/1:2.1.29-1ubuntu3.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.