----- Original Message ----- From: "Martin Marques" <martin@xxxxxxxxxxxxxxx> To: <fedora-legacy-list@xxxxxxxxxx> Sent: Thursday, October 05, 2006 7:19 AM Subject: Mailman vulnerability > I have a FC4 web server installed and got this mailman report: > > http://www.securityfocus.com/bid/19831/discuss > > Is it to worry? > > I am thinking about promoting it to FC5 but as it is a server in > production I want to make a very good plan first. > Hi Martin, Thanks for writing. Indeed, these are issues that we in Legacy need to deal with. As far as I can tell, the latest version of mailman released for FC4 was mailman-2.1.8-9.FC4.1, released around 9-May-2006. The issue discussed in that securityfocus BID 19831 indicates that mailman-2.1.8 is vulnerable to those issues. Red Hat Security Team (in RHSA-2006-0600) has rated two of the three CVE issues mentioned in BID 19831 as having a moderate security impact: "A flaw was found in the way Mailman handled MIME multipart mes- sages. An attacker could send a carefully crafted MIME multipart email message to a mailing list run by Mailman which caused that particular mailing list to stop working. (CVE-2006-2941) "Several cross-site scripting (XSS) issues were found in Mailman. An attacker could exploit these issues to perform cross-site scrip- ting attacks against the Mailman administrator. (CVE-2006-3636)" The third issue is CVE-2006-4624: "CRLF injection vulnerability in Utils.py in Mailman before 2.1.9rc1 allows remote attackers to spoof messages in the error log and possibly trick the administrator into visiting malicious URLs via a carriage return/line feed sequences in the URI." This issue has been given a low security impact, and hasn't yet been fixed by Red Hat Enterprise Linux. However, Fedora Core 6 Test 2 upgraded to mailman-2.1.9, which fixes all three problems. Would you like us to do similarly for FC4/FC3? Have entered Bug <https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=209891> for this issue. Regards, David Eisenstein -- fedora-legacy-list mailing list fedora-legacy-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-legacy-list
