Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
100
security advisoryXSSremote accessSUSE: 2022:1886-1 Important: Mailman Update to Fix Access Issues
An update that fixes four vulnerabilities is now available. . SUSE Security Update: Security update for mailman ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1886-1 Rating: important References: #1191959 #1192735 #1192741 #1193316 Cross-References: CVE-2021-42096 CVE-2021-43331 CVE-2021-43332 CVE-2021-44227 CVSS scores: CVE-2021-42096 (SUSE): 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-43331 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CVE-2021-43332 (SUSE): 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CVE-2021-44227 (SUSE): 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L Affected Products: HPE Helion Openstack 8 SUSE Linux Enterprise Server 12-SP2-BCL SUSE Linux Enterprise Server 12-SP3-BCL SUSE Linux Enterprise Server 12-SP3-LTSS SUSE Linux Enterprise Server 12-SP4-LTSS SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP 12-SP3 SUSE Linux Enterprise Server for SAP 12-SP4 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud Crowbar 9 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for mailman fixes the following issues: - CVE-2021-44227: Preventing list moderator or list member accessing the admin UI (bsc#1193316). - CVE-2021-43332: Preventing list moderator from cracking the list admin password encrypted in a CSRF token (bsc#1192741). - CVE-2021-43331: Fixed XSS in Cgi/options.py (bsc#1192735). - CVE-2021-42096: Add protection against remoteprivilege escalation via csrf_token derived from admin password (bsc#1191959). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud Crowbar 9: zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2022-1886=1 - SUSE OpenStack Cloud Crowbar 8: zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2022-1886=1 - SUSE OpenStack Cloud 9: zypper in -t patch SUSE-OpenStack-Cloud-9-2022-1886=1 - SUSE OpenStack Cloud 8: zypper in -t patch SUSE-OpenStack-Cloud-8-2022-1886=1 - SUSE Linux Enterprise Server for SAP 12-SP4: zypper in -t patch SUSE-SLE-SAP-12-SP4-2022-1886=1 - SUSE Linux Enterprise Server for SAP 12-SP3: zypper in -t patch SUSE-SLE-SAP-12-SP3-2022-1886=1 - SUSE Linux Enterprise Server 12-SP5: zypper in -t patch SUSE-SLE-SERVER-12-SP5-2022-1886=1 - SUSE Linux Enterprise Server 12-SP4-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2022-1886=1 - SUSE Linux Enterprise Server 12-SP3-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2022-1886=1 - SUSE Linux Enterprise Server 12-SP3-BCL: zypper in -t patch SUSE-SLE-SERVER-12-SP3-BCL-2022-1886=1 - SUSE Linux Enterprise Server 12-SP2-BCL: zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2022-1886=1 - HPE Helion Openstack 8: zypper in -t patch HPE-Helion-OpenStack-8-2022-1886=1 Package List: - SUSE OpenStack Cloud Crowbar 9 (x86_64): mailman-2.1.17-3.26.1 mailman-debuginfo-2.1.17-3.26.1 mailman-debugsource-2.1.17-3.26.1 - SUSE OpenStack Cloud Crowbar 8 (x86_64): mailman-2.1.17-3.26.1 mailman-debuginfo-2.1.17-3.26.1 mailman-debugsource-2.1.17-3.26.1 - SUSE OpenStack Cloud 9 (x86_64): mailman-2.1.17-3.26.1 mailman-debuginfo-2.1.17-3.26.1 mailman-debugsource-2.1.17-3.26.1 - SUSEOpenStack Cloud 8 (x86_64): mailman-2.1.17-3.26.1 mailman-debuginfo-2.1.17-3.26.1 mailman-debugsource-2.1.17-3.26.1 - SUSE Linux Enterprise Server for SAP 12-SP4 (ppc64le x86_64): mailman-2.1.17-3.26.1 mailman-debuginfo-2.1.17-3.26.1 mailman-debugsource-2.1.17-3.26.1 - SUSE Linux Enterprise Server for SAP 12-SP3 (ppc64le x86_64): mailman-2.1.17-3.26.1 mailman-debuginfo-2.1.17-3.26.1 mailman-debugsource-2.1.17-3.26.1 - SUSE Linux Enterprise Server 12-SP5 (aarch64 ppc64le s390x x86_64): mailman-2.1.17-3.26.1 mailman-debuginfo-2.1.17-3.26.1 mailman-debugsource-2.1.17-3.26.1 - SUSE Linux Enterprise Server 12-SP4-LTSS (ppc64le s390x x86_64): mailman-2.1.17-3.26.1 mailman-debuginfo-2.1.17-3.26.1 mailman-debugsource-2.1.17-3.26.1 - SUSE Linux Enterprise Server 12-SP3-LTSS (ppc64le s390x x86_64): mailman-2.1.17-3.26.1 mailman-debuginfo-2.1.17-3.26.1 mailman-debugsource-2.1.17-3.26.1 - SUSE Linux Enterprise Server 12-SP3-BCL (x86_64): mailman-2.1.17-3.26.1 mailman-debuginfo-2.1.17-3.26.1 mailman-debugsource-2.1.17-3.26.1 - SUSE Linux Enterprise Server 12-SP2-BCL (x86_64): mailman-2.1.17-3.26.1 mailman-debuginfo-2.1.17-3.26.1 mailman-debugsource-2.1.17-3.26.1 - HPE Helion Openstack 8 (x86_64): mailman-2.1.17-3.26.1 mailman-debuginfo-2.1.17-3.26.1 mailman-debugsource-2.1.17-3.26.1 References: https://www.suse.com/security/cve/CVE-2021-42096.html https://www.suse.com/security/cve/CVE-2021-43331.html https://www.suse.com/security/cve/CVE-2021-43332.html https://www.suse.com/security/cve/CVE-2021-44227.html https://bugzilla.suse.com/1191959 https://bugzilla.suse.com/1192735 https://bugzilla.suse.com/1192741 https://bugzilla.suse.com/1193316 . Mailman update released to address critical issues in multiple SUSE products, improving security and access controls.. SUSE Mailman Update, Security Patches,Linux Updates. . Severity: Important. LinuxSecurity.com Team
May 31, 2022
•Important
SuSE
98
security advisorysecurity issueRed Hat Enterprise LinuxRedHat 8.2 RHSA-2021-5080 Important: Mailman CSRF Bug Fix
An update for the mailman:2.1 module is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: mailman:2.1 security update Advisory ID: RHSA-2021:5080-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:5080 Issue date: 2021-12-13 CVE Names: CVE-2021-44227 ==================================================================== 1. Summary: An update for the mailman:2.1 module is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream EUS (v. 8.2) - aarch64, ppc64le, s390x, x86_64 3. Description: Mailman is a program used to help manage e-mail discussion lists. Security Fix(es): * mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover (CVE-2021-44227) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2026862 - CVE-2021-44227 mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover 6. Package List: Red Hat Enterprise Linux AppStream EUS (v.8.2): Source: mailman-2.1.29-6.module+el8.2.0+13543+86b2c701.src.rpm aarch64: mailman-2.1.29-6.module+el8.2.0+13543+86b2c701.aarch64.rpm mailman-debuginfo-2.1.29-6.module+el8.2.0+13543+86b2c701.aarch64.rpm mailman-debugsource-2.1.29-6.module+el8.2.0+13543+86b2c701.aarch64.rpm ppc64le: mailman-2.1.29-6.module+el8.2.0+13543+86b2c701.ppc64le.rpm mailman-debuginfo-2.1.29-6.module+el8.2.0+13543+86b2c701.ppc64le.rpm mailman-debugsource-2.1.29-6.module+el8.2.0+13543+86b2c701.ppc64le.rpm s390x: mailman-2.1.29-6.module+el8.2.0+13543+86b2c701.s390x.rpm mailman-debuginfo-2.1.29-6.module+el8.2.0+13543+86b2c701.s390x.rpm mailman-debugsource-2.1.29-6.module+el8.2.0+13543+86b2c701.s390x.rpm x86_64: mailman-2.1.29-6.module+el8.2.0+13543+86b2c701.x86_64.rpm mailman-debuginfo-2.1.29-6.module+el8.2.0+13543+86b2c701.x86_64.rpm mailman-debugsource-2.1.29-6.module+el8.2.0+13543+86b2c701.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2021-44227 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBYbdOctzjgjWX9erEAQg6Ng/+MNYDR5KefRn68QosWvhOsTJw7ZeZxpD2 KGk2VSTT9MrMNSfd2uDuwVlMtyfCiFwO9+TrG2ou18K2ebZdbyCkwkYbWmk2j1xW GAMMWrzhlg2eBsiFTrDR03Hhm4P8kKYPeQymLk/z/I05csvvpSp/uDi1znwxiK6N JdDBE2N5x7RmvoLZ5RT7wY2Rh6D6Akn73Jrbsca9Rvxeu7fd16xQUNzbPvANSUIt BGCY0Ry2m9wZNvEGrdoD6ofO9WrAvTbJnnTcwX1L3Vtj0ykaELQCnJaEfzZ7wHPW qoKFxre5TPWHN+krtdTrkd/V2at/ANK7stKqPaBCpyDE5qARRgcSVs9nUt2DCdx1 lYC4bQbAO7AHQWkBE/Euyz6TN/hej96MvuUT68foM4taRVe/OEDxhi685jP2JWoF CyXBrOCROAiszUJfDbb8gP+P6386qaED0pTh6o+RGaIV4FFBOaEBXxGkU93sGcvY ATA8GfiU7Hx5u4URWrLjB4xcQbjo28EFY4Ky896re2kR3kw80irEanFWqupb0zE3 5P+arSFV3EHVJf5fse7m4VagctuQ8yn4HwlW6kUAHwBGVTIOJGjq/JWVkV1xGe3L L44SbjRjynwA8Dpeb2k990GvBa/xPg1DCkS+hmpNi2whm/fwtB19yOSgr8EkWO7N 6u77NOONp3M=6HtR -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Dec 13, 2021
•Important
Red Hat
199
security advisorysecurity issueimportant patchCentOS: CESA-2021-4913 Important Mailman Security Update
Upstream details at : https://access.redhat.com/errata/RHSA-2021:4913. CentOS Errata and Security Advisory 2021:4913 Important Upstream details at : https://access.redhat.com/errata/RHSA-2021:4913 The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) x86_64: c990d11d35716ef252caf3630273bd9502a4f8556105b0ee8005c3164ce118df mailman-2.1.15-30.el7_9.2.x86_64.rpm Source: 2ecd2a6efdc51942b93dd42a1132cdbf0499cb488c0bc85068533048df97d594 mailman-2.1.15-30.el7_9.2.src.rpm -- Johnny Hughes CentOS Project { https://www.centos.org/ } irc: hughesjr, #
Dec 02, 2021
•Important
CentOS
200
security advisorydenial of servicesecurity fixScientific Linux 4.x: Mailman Update Moderate: Service Denial
An updated mailman package that fixes a denial of service flaw. Date: Mon, 12 Jun 2006 15:01:40 -0500 Reply-To: Connie Sieh Sender: Security Errata for Scientific Linux From: Connie Sieh Subject: Re: ERRATA for "mysql" on SL 40,41,42,43 i386,x86_64 now available Comments: To: scientific In-Reply-To: Note that this is a update from 4.1.12 to 4.1.20. The Upstream vendor did NOT backport the security patches. -Connie Sieh On Mon, 12 Jun 2006, Connie Sieh wrote: > On Mon, 12 Jun 2006, Connie Sieh wrote: > > > The ERRATA for SL 40,41,42,43 i386,x86_64 are now available from: > > > > > > Synopsis: Updated mysql packages that fix multiple security flaws are now > > available > > > > Severity: important > > > > Issued on: 2006-06-09 > > > > CVEs: CVE-2006-0903 > > CVE-2006-2753 > > CVE-2006-1517 > > CVE-2006-1516 > > > > SRPMS > > mysql-4.1.20-1.RHEL4.1.src.rpm > > i386 > > mysql-4.1.20-1.RHEL4.1.i386.rpm > > mysql-bench-4.1.20-1.RHEL4.1.i386.rpm > > mysql-devel-4.1.20-1.RHEL4.1.i386.rpm > > mysql-server-4.1.20-1.RHEL4.1.i386.rpm > > x86_64 > > mysql-4.1.20-1.RHEL4.1.i386.rpm > > mysql-4.1.20-1.RHEL4.1.x86_64.rpm > > mysql-bench-4.1.20-1.RHEL4.1.x86_64.rpm > > mysql-devel-4.1.20-1.RHEL4.1.x86_64.rpm > > mysql-server-4.1.20-1.RHEL4.1.x86_64.rpm > > > > > --Connie Sieh > > --Troy Dawson > > > Date: Tue, 13 Jun 2006 17:30:06 -0500 Reply-To: Connie Sieh Sender: Security Errata for Scientific Linux From: Connie Sieh Subject: ERRATA for "mailman" on SL 41 ia64 now available Comments: To: scientific The following ERRATA for SL 41 ia64 are now available from: Synopsis: An updated mailman package that fixes a denial of service flaw is now available for Scientific Linux 4.x Severity: moderate Issued on: 2006-06-09 CVEs: CVE-2006-0052 SRPMS mailman-2.1.5.1-34.rhel4.3.src.rpm ia64 mailman-2.1.5.1-34.rhel4.3.ia64.rpm -Jarek Polok -Connie Sieh . New mailman update released for Scientific Linux 4.x addressing a denialof service vulnerability, published on 2006-06-09.. Scientific Linux Update, Mailman Denial of Service, Security Fix, Linux Package Management. . LinuxSecurity.com Team
Jun 13, 2006
Scientific Linux
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!