Headline
CVE-2020-12137: security - Re: mailman 2.x: XSS via file attachments in list archives
GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.
- Products
- Openwall GNU/*/Linux server OS
- Linux Kernel Runtime Guard
- John the Ripper password cracker
- Free & Open Source for any platform
- in the cloud
- Pro for Linux
- Pro for macOS
- Wordlists for password cracking
- passwdqc policy enforcement
- Free & Open Source for Unix
- Pro for Windows (Active Directory)
- yescrypt KDF & password hashing
- yespower Proof-of-Work (PoW)
- crypt_blowfish password hashing
- phpass ditto in PHP
- tcb better password shadowing
- Pluggable Authentication Modules
- scanlogd port scan detector
- popa3d tiny POP3 daemon
- blists web interface to mailing lists
- msulogin single user mode login
- php_mt_seed mt_rand() cracker
- Services
- Publications
- Articles
- Presentations
- Resources
- Mailing lists
- Community wiki
- Source code repositories (GitHub)
- Source code repositories (CVSweb)
- File archive & mirrors
- How to verify digital signatures
- OVE IDs
- What’s new
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 24 Feb 2020 11:06:38 -0500 From: Jim Popovitch <jim@…qc.com> To: oss-security@…ts.openwall.com Subject: Re: mailman 2.x: XSS via file attachments in list archives
On Mon, 2020-02-24 at 15:34 +0100, Hanno Böck wrote:
This change is in mailman 2.1.30rc1, but not in any stable release of mailman.
Just for some added info, Mailman v2.1.30 is almost released, the holdup is with some language translations. Mailman v2.1.30 will be the last of the Mailman v2 releases as primary development and effort has long shifted to Mailman v3. Further, the Mailman v2 branch is tied to Python v2, which is now EOL by the fine Python folk.
Once Mailman v2.1.30 is release, I’m sure the various distributions will pull the commit and merge the particulars into their release branches, and that will surely include this XSS fix.
I’m not a formal Mailman Developer, but as a contributor and member of the general Mailman Community I say Thank You to Hanno for identifying and reporting this vulnerability.
-Jim P.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.