Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2016-6893 (GCVE-0-2016-6893)
Vulnerability from cvelistv5 – Published: 2016-09-02 14:00 – Updated: 2024-08-06 01:43
VLAI?
EPSS
Summary
Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:43:38.450Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "DSA-3668",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3668"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.launchpad.net/bugs/1614841"
},
{
"name": "92731",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92731"
},
{
"name": "1036728",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1036728"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-09-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim\u0027s account."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-12T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "DSA-3668",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3668"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.launchpad.net/bugs/1614841"
},
{
"name": "92731",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92731"
},
{
"name": "1036728",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1036728"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6893",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim\u0027s account."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "DSA-3668",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3668"
},
{
"name": "https://bugs.launchpad.net/bugs/1614841",
"refsource": "CONFIRM",
"url": "https://bugs.launchpad.net/bugs/1614841"
},
{
"name": "92731",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92731"
},
{
"name": "1036728",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1036728"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-6893",
"datePublished": "2016-09-02T14:00:00",
"dateReserved": "2016-08-19T00:00:00",
"dateUpdated": "2024-08-06T01:43:38.450Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B1D6A976-FFEA-4DB6-B002-8036E778C78E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B8894855-E303-4B55-B3BC-DCBE3A0AB703\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0B1500D8-952A-46C6-920C-096760C36A43\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"503D7346-4891-40B1-A0CD-0FACC5359431\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"643610C6-99A9-43C9-A8FC-463A244C08DE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"45C53260-503F-4934-B1FE-9FACD8E0EE66\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A34CBFC5-CB18-4FE4-9B4D-F3280CBCCD6C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E2571330-3239-469E-883D-8994257D0C55\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5F27323B-6B10-4941-B20B-187562797D44\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"890FEDE2-474A-4870-9165-CAD39BC6D318\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.10:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"D4FFE8F2-B665-41F1-B4C5-E7C66BE91E24\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.10b1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8C08F313-30E9-4B9E-BA5A-4910DD5E155C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.10b3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D9B09DFC-A238-49CA-9DB8-F4052775BF3D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.10b4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C219D531-3E3A-4B85-B3A6-8A4335E86AB7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.11:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A1C7EEDB-5794-419A-8E61-137DB76A4E15\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"C1FC55D7-3857-4614-82FC-5266A3BD8FE8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"A64FECFD-F6BF-49C1-926C-41868787378C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.12:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5F7A3B58-4038-41AE-A42E-BE743A14D5A2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"2C3215CB-7146-49D3-B350-A07E0C9FB04D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.12:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"800F3CE3-CEE2-4C63-B0DD-F9F72E9F1B71\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.13:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2019E834-DFF4-4C9A-82D1-E768EA8934EF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.13:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"E3D1CC02-7D5F-41CB-A881-A82A13CE9EE5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.14:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"11010D5F-AA02-45EC-B007-47BF9194250B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.14:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"A677EC3D-A08A-44B8-B7E1-F229F515F407\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.14-1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"876E65AB-6D2E-41C2-899E-7D5EE176F877\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.15:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7985A5B3-0473-426D-9F8D-63B81C7D1177\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.15:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"6B211D97-5316-4EB1-999D-26C53708F200\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.16:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F6AC4D1E-B92F-400A-8B73-CB99E5825A05\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.16:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"5BB702F4-324D-4B87-9590-22CD2465A708\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.16:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"47B47F16-4E68-4DB2-9C61-DBABB75C7A99\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.16:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"11931F41-6B65-4C1B-9A82-8F89F093E9AA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.17:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"59A972C3-06C4-4DED-825C-B1931B35E135\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.18:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6BB3C5C8-98AC-4BC3-A06E-6F2920CA951B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.18:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"1C3BC472-4428-4786-A3AA-390C66553DC0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.18:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"69B95EB8-6D8B-4342-A6A8-472BF1190A87\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.18:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"011CD4BF-FE51-40A7-B457-884DDF3C7FFC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.18-1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9C2DA8DD-77C1-44A0-9A49-FB1CEE26CB1E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.19:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"68C51AFA-3C45-48A2-8ADC-514BF5374413\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.19:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"BF11D5FD-FCD5-4147-876C-09980D05152C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.19:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"503671C5-1F2A-4676-8D58-86C2D01405E5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.19:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"5154BCB6-2216-433E-BC77-B862490545F4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.20:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E73970DC-7F70-437E-A669-B0EE6F4629AF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.21:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"13081A16-D625-4AD1-9493-AFA5126269C6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.21:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"F6F40EE5-9E50-4703-9151-4640B11C78A6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.22:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"51028759-33CD-4C80-A534-B46E62C03F4D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gnu:mailman:2.1.23:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"683F421B-C986-4572-9612-1635AF7DD084\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim\u0027s account.\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad de CSRF en la p\\u00e1gina de opciones de usuario en GNU Mailman 2.1.x en versiones anteriores a 2.1.23 permite a atacantes remotos secuestrar la autenticaci\\u00f3n de usuarios arbitrarios para peticiones que modifican una opci\\u00f3n, tal como se demuestra ganando acceso a las credenciales de una cuenta de una v\\u00edctima.\"}]",
"id": "CVE-2016-6893",
"lastModified": "2024-11-21T02:57:02.453",
"metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:P/A:P\", \"baseScore\": 6.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
"published": "2016-09-02T14:59:09.283",
"references": "[{\"url\": \"http://www.debian.org/security/2016/dsa-3668\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/bid/92731\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securitytracker.com/id/1036728\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://bugs.launchpad.net/bugs/1614841\", \"source\": \"cve@mitre.org\", \"tags\": [\"Issue Tracking\"]}, {\"url\": \"http://www.debian.org/security/2016/dsa-3668\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/92731\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securitytracker.com/id/1036728\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://bugs.launchpad.net/bugs/1614841\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\"]}]",
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-352\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2016-6893\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2016-09-02T14:59:09.283\",\"lastModified\":\"2025-04-12T10:46:40.837\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim\u0027s account.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de CSRF en la p\u00e1gina de opciones de usuario en GNU Mailman 2.1.x en versiones anteriores a 2.1.23 permite a atacantes remotos secuestrar la autenticaci\u00f3n de usuarios arbitrarios para peticiones que modifican una opci\u00f3n, tal como se demuestra ganando acceso a las credenciales de una cuenta de una v\u00edctima.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1D6A976-FFEA-4DB6-B002-8036E778C78E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8894855-E303-4B55-B3BC-DCBE3A0AB703\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B1500D8-952A-46C6-920C-096760C36A43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"503D7346-4891-40B1-A0CD-0FACC5359431\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"643610C6-99A9-43C9-A8FC-463A244C08DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"45C53260-503F-4934-B1FE-9FACD8E0EE66\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A34CBFC5-CB18-4FE4-9B4D-F3280CBCCD6C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2571330-3239-469E-883D-8994257D0C55\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F27323B-6B10-4941-B20B-187562797D44\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"890FEDE2-474A-4870-9165-CAD39BC6D318\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"D4FFE8F2-B665-41F1-B4C5-E7C66BE91E24\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.10b1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C08F313-30E9-4B9E-BA5A-4910DD5E155C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.10b3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9B09DFC-A238-49CA-9DB8-F4052775BF3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.10b4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C219D531-3E3A-4B85-B3A6-8A4335E86AB7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1C7EEDB-5794-419A-8E61-137DB76A4E15\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"C1FC55D7-3857-4614-82FC-5266A3BD8FE8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A64FECFD-F6BF-49C1-926C-41868787378C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F7A3B58-4038-41AE-A42E-BE743A14D5A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C3215CB-7146-49D3-B350-A07E0C9FB04D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"800F3CE3-CEE2-4C63-B0DD-F9F72E9F1B71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2019E834-DFF4-4C9A-82D1-E768EA8934EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3D1CC02-7D5F-41CB-A881-A82A13CE9EE5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"11010D5F-AA02-45EC-B007-47BF9194250B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A677EC3D-A08A-44B8-B7E1-F229F515F407\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.14-1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"876E65AB-6D2E-41C2-899E-7D5EE176F877\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7985A5B3-0473-426D-9F8D-63B81C7D1177\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6B211D97-5316-4EB1-999D-26C53708F200\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F6AC4D1E-B92F-400A-8B73-CB99E5825A05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"5BB702F4-324D-4B87-9590-22CD2465A708\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"47B47F16-4E68-4DB2-9C61-DBABB75C7A99\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"11931F41-6B65-4C1B-9A82-8F89F093E9AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"59A972C3-06C4-4DED-825C-B1931B35E135\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6BB3C5C8-98AC-4BC3-A06E-6F2920CA951B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.18:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"1C3BC472-4428-4786-A3AA-390C66553DC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.18:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"69B95EB8-6D8B-4342-A6A8-472BF1190A87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.18:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"011CD4BF-FE51-40A7-B457-884DDF3C7FFC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.18-1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9C2DA8DD-77C1-44A0-9A49-FB1CEE26CB1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"68C51AFA-3C45-48A2-8ADC-514BF5374413\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF11D5FD-FCD5-4147-876C-09980D05152C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"503671C5-1F2A-4676-8D58-86C2D01405E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"5154BCB6-2216-433E-BC77-B862490545F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E73970DC-7F70-437E-A669-B0EE6F4629AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"13081A16-D625-4AD1-9493-AFA5126269C6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.21:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"F6F40EE5-9E50-4703-9151-4640B11C78A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"51028759-33CD-4C80-A534-B46E62C03F4D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gnu:mailman:2.1.23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"683F421B-C986-4572-9612-1635AF7DD084\"}]}]}],\"references\":[{\"url\":\"http://www.debian.org/security/2016/dsa-3668\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/92731\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securitytracker.com/id/1036728\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://bugs.launchpad.net/bugs/1614841\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"http://www.debian.org/security/2016/dsa-3668\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/92731\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id/1036728\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugs.launchpad.net/bugs/1614841\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\"]}]}}"
}
}
RHSA-2021_4913
Vulnerability from csaf_redhat - Published: 2021-12-02 16:31 - Updated: 2024-11-22 17:56Summary
Red Hat Security Advisory: mailman security update
Notes
Topic
An update for mailman is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mailman is a program used to help manage e-mail discussion lists.
Security Fix(es):
* mailman: CSRF token bypass allows to perform CSRF attacks and account takeover (CVE-2021-42097)
* mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover (CVE-2021-44227)
* mailman: CSRF protection missing in the user options page (CVE-2016-6893)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for mailman is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Mailman is a program used to help manage e-mail discussion lists.\n\nSecurity Fix(es):\n\n* mailman: CSRF token bypass allows to perform CSRF attacks and account takeover (CVE-2021-42097)\n\n* mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover (CVE-2021-44227)\n\n* mailman: CSRF protection missing in the user options page (CVE-2016-6893)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:4913",
"url": "https://access.redhat.com/errata/RHSA-2021:4913"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1370155",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1370155"
},
{
"category": "external",
"summary": "2020568",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2020568"
},
{
"category": "external",
"summary": "2026862",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2026862"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4913.json"
}
],
"title": "Red Hat Security Advisory: mailman security update",
"tracking": {
"current_release_date": "2024-11-22T17:56:00+00:00",
"generator": {
"date": "2024-11-22T17:56:00+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2021:4913",
"initial_release_date": "2021-12-02T16:31:22+00:00",
"revision_history": [
{
"date": "2021-12-02T16:31:22+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-12-02T16:31:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T17:56:00+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.9.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.9.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-3:2.1.15-30.el7_9.2.src",
"product": {
"name": "mailman-3:2.1.15-30.el7_9.2.src",
"product_id": "mailman-3:2.1.15-30.el7_9.2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mailman@2.1.15-30.el7_9.2?arch=src\u0026epoch=3"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-3:2.1.15-30.el7_9.2.ppc64le",
"product": {
"name": "mailman-3:2.1.15-30.el7_9.2.ppc64le",
"product_id": "mailman-3:2.1.15-30.el7_9.2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mailman@2.1.15-30.el7_9.2?arch=ppc64le\u0026epoch=3"
}
}
},
{
"category": "product_version",
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"product": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"product_id": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.15-30.el7_9.2?arch=ppc64le\u0026epoch=3"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-3:2.1.15-30.el7_9.2.ppc64",
"product": {
"name": "mailman-3:2.1.15-30.el7_9.2.ppc64",
"product_id": "mailman-3:2.1.15-30.el7_9.2.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mailman@2.1.15-30.el7_9.2?arch=ppc64\u0026epoch=3"
}
}
},
{
"category": "product_version",
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"product": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"product_id": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.15-30.el7_9.2?arch=ppc64\u0026epoch=3"
}
}
}
],
"category": "architecture",
"name": "ppc64"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-3:2.1.15-30.el7_9.2.s390x",
"product": {
"name": "mailman-3:2.1.15-30.el7_9.2.s390x",
"product_id": "mailman-3:2.1.15-30.el7_9.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mailman@2.1.15-30.el7_9.2?arch=s390x\u0026epoch=3"
}
}
},
{
"category": "product_version",
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"product": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"product_id": "mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.15-30.el7_9.2?arch=s390x\u0026epoch=3"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-3:2.1.15-30.el7_9.2.x86_64",
"product": {
"name": "mailman-3:2.1.15-30.el7_9.2.x86_64",
"product_id": "mailman-3:2.1.15-30.el7_9.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mailman@2.1.15-30.el7_9.2?arch=x86_64\u0026epoch=3"
}
}
},
{
"category": "product_version",
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"product": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"product_id": "mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.15-30.el7_9.2?arch=x86_64\u0026epoch=3"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-3:2.1.15-30.el7_9.2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64"
},
"product_reference": "mailman-3:2.1.15-30.el7_9.2.ppc64",
"relates_to_product_reference": "7Server-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-3:2.1.15-30.el7_9.2.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le"
},
"product_reference": "mailman-3:2.1.15-30.el7_9.2.ppc64le",
"relates_to_product_reference": "7Server-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-3:2.1.15-30.el7_9.2.s390x as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x"
},
"product_reference": "mailman-3:2.1.15-30.el7_9.2.s390x",
"relates_to_product_reference": "7Server-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-3:2.1.15-30.el7_9.2.src as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src"
},
"product_reference": "mailman-3:2.1.15-30.el7_9.2.src",
"relates_to_product_reference": "7Server-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-3:2.1.15-30.el7_9.2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64"
},
"product_reference": "mailman-3:2.1.15-30.el7_9.2.x86_64",
"relates_to_product_reference": "7Server-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64"
},
"product_reference": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"relates_to_product_reference": "7Server-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le"
},
"product_reference": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"relates_to_product_reference": "7Server-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x"
},
"product_reference": "mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"relates_to_product_reference": "7Server-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
},
"product_reference": "mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"relates_to_product_reference": "7Server-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-3:2.1.15-30.el7_9.2.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64"
},
"product_reference": "mailman-3:2.1.15-30.el7_9.2.ppc64",
"relates_to_product_reference": "7Workstation-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-3:2.1.15-30.el7_9.2.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le"
},
"product_reference": "mailman-3:2.1.15-30.el7_9.2.ppc64le",
"relates_to_product_reference": "7Workstation-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-3:2.1.15-30.el7_9.2.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x"
},
"product_reference": "mailman-3:2.1.15-30.el7_9.2.s390x",
"relates_to_product_reference": "7Workstation-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-3:2.1.15-30.el7_9.2.src as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src"
},
"product_reference": "mailman-3:2.1.15-30.el7_9.2.src",
"relates_to_product_reference": "7Workstation-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-3:2.1.15-30.el7_9.2.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64"
},
"product_reference": "mailman-3:2.1.15-30.el7_9.2.x86_64",
"relates_to_product_reference": "7Workstation-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64"
},
"product_reference": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"relates_to_product_reference": "7Workstation-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le"
},
"product_reference": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"relates_to_product_reference": "7Workstation-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x"
},
"product_reference": "mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"relates_to_product_reference": "7Workstation-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
},
"product_reference": "mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"relates_to_product_reference": "7Workstation-7.9.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-6893",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"discovery_date": "2016-08-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1370155"
}
],
"notes": [
{
"category": "description",
"text": "Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim\u0027s account.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mailman: CSRF protection missing in the user options page",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6893"
},
{
"category": "external",
"summary": "RHBZ#1370155",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1370155"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6893",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6893"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6893",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6893"
}
],
"release_date": "2016-08-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-12-02T16:31:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4913"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "mailman: CSRF protection missing in the user options page"
},
{
"cve": "CVE-2021-42097",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"discovery_date": "2021-11-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2020568"
}
],
"notes": [
{
"category": "description",
"text": "A Cross-Site Request Forgery (CSRF) attack can be performed in mailman due to a CSRF token bypass. CSRF tokens are not checked against the right user and a token created by one user can be used by another one to perform a request, effectively bypassing the protection provided by CSRF tokens. A remote attacker with an account on the mailman system can use this flaw to perform a CSRF attack and perform operations on behalf of the victim user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mailman: CSRF token bypass allows to perform CSRF attacks and account takeover",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-42097"
},
{
"category": "external",
"summary": "RHBZ#2020568",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2020568"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-42097",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42097"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-42097",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42097"
}
],
"release_date": "2021-10-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-12-02T16:31:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4913"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mailman: CSRF token bypass allows to perform CSRF attacks and account takeover"
},
{
"acknowledgments": [
{
"names": [
"Riccardo Schirone"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2021-44227",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"discovery_date": "2021-11-23T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2026862"
}
],
"notes": [
{
"category": "description",
"text": "A Cross-Site Request Forgery (CSRF) attack can be performed in mailman due to a CSRF token bypass. CSRF tokens are not checked against the right type of user when performing admin operations and a token created by a regular user can be used by an admin to perform an admin-level request, effectively bypassing the protection provided by CSRF tokens. A remote attacker with an account on the mailman system can use this flaw to perform a CSRF attack and perform operations on behalf of the victim admin.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-44227"
},
{
"category": "external",
"summary": "RHBZ#2026862",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2026862"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-44227",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44227"
}
],
"release_date": "2021-11-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-12-02T16:31:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4913"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover"
}
]
}
RHSA-2021:4913
Vulnerability from csaf_redhat - Published: 2021-12-02 16:31 - Updated: 2025-11-21 18:27Summary
Red Hat Security Advisory: mailman security update
Notes
Topic
An update for mailman is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mailman is a program used to help manage e-mail discussion lists.
Security Fix(es):
* mailman: CSRF token bypass allows to perform CSRF attacks and account takeover (CVE-2021-42097)
* mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover (CVE-2021-44227)
* mailman: CSRF protection missing in the user options page (CVE-2016-6893)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for mailman is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Mailman is a program used to help manage e-mail discussion lists.\n\nSecurity Fix(es):\n\n* mailman: CSRF token bypass allows to perform CSRF attacks and account takeover (CVE-2021-42097)\n\n* mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover (CVE-2021-44227)\n\n* mailman: CSRF protection missing in the user options page (CVE-2016-6893)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:4913",
"url": "https://access.redhat.com/errata/RHSA-2021:4913"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1370155",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1370155"
},
{
"category": "external",
"summary": "2020568",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2020568"
},
{
"category": "external",
"summary": "2026862",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2026862"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4913.json"
}
],
"title": "Red Hat Security Advisory: mailman security update",
"tracking": {
"current_release_date": "2025-11-21T18:27:11+00:00",
"generator": {
"date": "2025-11-21T18:27:11+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2021:4913",
"initial_release_date": "2021-12-02T16:31:22+00:00",
"revision_history": [
{
"date": "2021-12-02T16:31:22+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-12-02T16:31:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T18:27:11+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.9.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.9.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-3:2.1.15-30.el7_9.2.src",
"product": {
"name": "mailman-3:2.1.15-30.el7_9.2.src",
"product_id": "mailman-3:2.1.15-30.el7_9.2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mailman@2.1.15-30.el7_9.2?arch=src\u0026epoch=3"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-3:2.1.15-30.el7_9.2.ppc64le",
"product": {
"name": "mailman-3:2.1.15-30.el7_9.2.ppc64le",
"product_id": "mailman-3:2.1.15-30.el7_9.2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mailman@2.1.15-30.el7_9.2?arch=ppc64le\u0026epoch=3"
}
}
},
{
"category": "product_version",
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"product": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"product_id": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.15-30.el7_9.2?arch=ppc64le\u0026epoch=3"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-3:2.1.15-30.el7_9.2.ppc64",
"product": {
"name": "mailman-3:2.1.15-30.el7_9.2.ppc64",
"product_id": "mailman-3:2.1.15-30.el7_9.2.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mailman@2.1.15-30.el7_9.2?arch=ppc64\u0026epoch=3"
}
}
},
{
"category": "product_version",
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"product": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"product_id": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.15-30.el7_9.2?arch=ppc64\u0026epoch=3"
}
}
}
],
"category": "architecture",
"name": "ppc64"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-3:2.1.15-30.el7_9.2.s390x",
"product": {
"name": "mailman-3:2.1.15-30.el7_9.2.s390x",
"product_id": "mailman-3:2.1.15-30.el7_9.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mailman@2.1.15-30.el7_9.2?arch=s390x\u0026epoch=3"
}
}
},
{
"category": "product_version",
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"product": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"product_id": "mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.15-30.el7_9.2?arch=s390x\u0026epoch=3"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-3:2.1.15-30.el7_9.2.x86_64",
"product": {
"name": "mailman-3:2.1.15-30.el7_9.2.x86_64",
"product_id": "mailman-3:2.1.15-30.el7_9.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mailman@2.1.15-30.el7_9.2?arch=x86_64\u0026epoch=3"
}
}
},
{
"category": "product_version",
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"product": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"product_id": "mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mailman-debuginfo@2.1.15-30.el7_9.2?arch=x86_64\u0026epoch=3"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-3:2.1.15-30.el7_9.2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64"
},
"product_reference": "mailman-3:2.1.15-30.el7_9.2.ppc64",
"relates_to_product_reference": "7Server-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-3:2.1.15-30.el7_9.2.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le"
},
"product_reference": "mailman-3:2.1.15-30.el7_9.2.ppc64le",
"relates_to_product_reference": "7Server-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-3:2.1.15-30.el7_9.2.s390x as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x"
},
"product_reference": "mailman-3:2.1.15-30.el7_9.2.s390x",
"relates_to_product_reference": "7Server-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-3:2.1.15-30.el7_9.2.src as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src"
},
"product_reference": "mailman-3:2.1.15-30.el7_9.2.src",
"relates_to_product_reference": "7Server-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-3:2.1.15-30.el7_9.2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64"
},
"product_reference": "mailman-3:2.1.15-30.el7_9.2.x86_64",
"relates_to_product_reference": "7Server-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64"
},
"product_reference": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"relates_to_product_reference": "7Server-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le"
},
"product_reference": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"relates_to_product_reference": "7Server-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x"
},
"product_reference": "mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"relates_to_product_reference": "7Server-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
},
"product_reference": "mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"relates_to_product_reference": "7Server-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-3:2.1.15-30.el7_9.2.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64"
},
"product_reference": "mailman-3:2.1.15-30.el7_9.2.ppc64",
"relates_to_product_reference": "7Workstation-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-3:2.1.15-30.el7_9.2.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le"
},
"product_reference": "mailman-3:2.1.15-30.el7_9.2.ppc64le",
"relates_to_product_reference": "7Workstation-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-3:2.1.15-30.el7_9.2.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x"
},
"product_reference": "mailman-3:2.1.15-30.el7_9.2.s390x",
"relates_to_product_reference": "7Workstation-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-3:2.1.15-30.el7_9.2.src as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src"
},
"product_reference": "mailman-3:2.1.15-30.el7_9.2.src",
"relates_to_product_reference": "7Workstation-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-3:2.1.15-30.el7_9.2.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64"
},
"product_reference": "mailman-3:2.1.15-30.el7_9.2.x86_64",
"relates_to_product_reference": "7Workstation-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64"
},
"product_reference": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"relates_to_product_reference": "7Workstation-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le"
},
"product_reference": "mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"relates_to_product_reference": "7Workstation-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x"
},
"product_reference": "mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"relates_to_product_reference": "7Workstation-7.9.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
},
"product_reference": "mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"relates_to_product_reference": "7Workstation-7.9.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-6893",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"discovery_date": "2016-08-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1370155"
}
],
"notes": [
{
"category": "description",
"text": "Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim\u0027s account.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mailman: CSRF protection missing in the user options page",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6893"
},
{
"category": "external",
"summary": "RHBZ#1370155",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1370155"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6893",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6893"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6893",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6893"
}
],
"release_date": "2016-08-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-12-02T16:31:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4913"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "mailman: CSRF protection missing in the user options page"
},
{
"cve": "CVE-2021-42097",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"discovery_date": "2021-11-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2020568"
}
],
"notes": [
{
"category": "description",
"text": "A Cross-Site Request Forgery (CSRF) attack can be performed in mailman due to a CSRF token bypass. CSRF tokens are not checked against the right user and a token created by one user can be used by another one to perform a request, effectively bypassing the protection provided by CSRF tokens. A remote attacker with an account on the mailman system can use this flaw to perform a CSRF attack and perform operations on behalf of the victim user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mailman: CSRF token bypass allows to perform CSRF attacks and account takeover",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-42097"
},
{
"category": "external",
"summary": "RHBZ#2020568",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2020568"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-42097",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42097"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-42097",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42097"
}
],
"release_date": "2021-10-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-12-02T16:31:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4913"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mailman: CSRF token bypass allows to perform CSRF attacks and account takeover"
},
{
"acknowledgments": [
{
"names": [
"Riccardo Schirone"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2021-44227",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"discovery_date": "2021-11-23T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2026862"
}
],
"notes": [
{
"category": "description",
"text": "A Cross-Site Request Forgery (CSRF) attack can be performed in mailman due to a CSRF token bypass. CSRF tokens are not checked against the right type of user when performing admin operations and a token created by a regular user can be used by an admin to perform an admin-level request, effectively bypassing the protection provided by CSRF tokens. A remote attacker with an account on the mailman system can use this flaw to perform a CSRF attack and perform operations on behalf of the victim admin.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2021-44227"
},
{
"category": "external",
"summary": "RHBZ#2026862",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2026862"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2021-44227",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-44227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44227"
}
],
"release_date": "2021-11-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-12-02T16:31:22+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:4913"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Server-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Server-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.src",
"7Workstation-7.9.Z:mailman-3:2.1.15-30.el7_9.2.x86_64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.ppc64le",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.s390x",
"7Workstation-7.9.Z:mailman-debuginfo-3:2.1.15-30.el7_9.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover"
}
]
}
SUSE-SU-2019:14068-1
Vulnerability from csaf_suse - Published: 2019-05-31 06:11 - Updated: 2019-05-31 06:11Summary
Security update for mailman
Notes
Title of the patch
Security update for mailman
Description of the patch
This update for mailman fixes the following issues:
Security issue fixed:
- CVE-2016-6893: Fixed a Cross-site request forgery vulnerability in the admin web interface (bsc#997205).
Following bug was fixed:
- Allow CSRF check to pass in mailman web frontend if the list
name contains a '+' (bsc#1102416)
Patchnames
sleposp3-mailman-14068,slessp4-mailman-14068
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for mailman",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for mailman fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2016-6893: Fixed a Cross-site request forgery vulnerability in the admin web interface (bsc#997205).\n\nFollowing bug was fixed:\n\n- Allow CSRF check to pass in mailman web frontend if the list\n name contains a \u0027+\u0027 (bsc#1102416)\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "sleposp3-mailman-14068,slessp4-mailman-14068",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_14068-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2019:14068-1",
"url": "https://www.suse.com/support/update/announcement/2019/suse-su-201914068-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2019:14068-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2019-May/005519.html"
},
{
"category": "self",
"summary": "SUSE Bug 1102416",
"url": "https://bugzilla.suse.com/1102416"
},
{
"category": "self",
"summary": "SUSE Bug 997205",
"url": "https://bugzilla.suse.com/997205"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6893 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6893/"
}
],
"title": "Security update for mailman",
"tracking": {
"current_release_date": "2019-05-31T06:11:00Z",
"generator": {
"date": "2019-05-31T06:11:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2019:14068-1",
"initial_release_date": "2019-05-31T06:11:00Z",
"revision_history": [
{
"date": "2019-05-31T06:11:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.15-9.6.12.1.i586",
"product": {
"name": "mailman-2.1.15-9.6.12.1.i586",
"product_id": "mailman-2.1.15-9.6.12.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.15-9.6.12.1.ppc64",
"product": {
"name": "mailman-2.1.15-9.6.12.1.ppc64",
"product_id": "mailman-2.1.15-9.6.12.1.ppc64"
}
}
],
"category": "architecture",
"name": "ppc64"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.15-9.6.12.1.s390x",
"product": {
"name": "mailman-2.1.15-9.6.12.1.s390x",
"product_id": "mailman-2.1.15-9.6.12.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.15-9.6.12.1.x86_64",
"product": {
"name": "mailman-2.1.15-9.6.12.1.x86_64",
"product_id": "mailman-2.1.15-9.6.12.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Point of Sale 11 SP3",
"product": {
"name": "SUSE Linux Enterprise Point of Sale 11 SP3",
"product_id": "SUSE Linux Enterprise Point of Sale 11 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-pos:11:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 11 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 11 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_sles:11:sp4"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.12.1.i586 as component of SUSE Linux Enterprise Point of Sale 11 SP3",
"product_id": "SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.12.1.i586"
},
"product_reference": "mailman-2.1.15-9.6.12.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Point of Sale 11 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.12.1.i586 as component of SUSE Linux Enterprise Server 11 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP4-LTSS:mailman-2.1.15-9.6.12.1.i586"
},
"product_reference": "mailman-2.1.15-9.6.12.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.12.1.ppc64 as component of SUSE Linux Enterprise Server 11 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP4-LTSS:mailman-2.1.15-9.6.12.1.ppc64"
},
"product_reference": "mailman-2.1.15-9.6.12.1.ppc64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.12.1.s390x as component of SUSE Linux Enterprise Server 11 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP4-LTSS:mailman-2.1.15-9.6.12.1.s390x"
},
"product_reference": "mailman-2.1.15-9.6.12.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.12.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP4-LTSS:mailman-2.1.15-9.6.12.1.x86_64"
},
"product_reference": "mailman-2.1.15-9.6.12.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4-LTSS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-6893",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6893"
}
],
"notes": [
{
"category": "general",
"text": "Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim\u0027s account.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.12.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:mailman-2.1.15-9.6.12.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:mailman-2.1.15-9.6.12.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:mailman-2.1.15-9.6.12.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:mailman-2.1.15-9.6.12.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6893",
"url": "https://www.suse.com/security/cve/CVE-2016-6893"
},
{
"category": "external",
"summary": "SUSE Bug 995352 for CVE-2016-6893",
"url": "https://bugzilla.suse.com/995352"
},
{
"category": "external",
"summary": "SUSE Bug 997205 for CVE-2016-6893",
"url": "https://bugzilla.suse.com/997205"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.12.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:mailman-2.1.15-9.6.12.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:mailman-2.1.15-9.6.12.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:mailman-2.1.15-9.6.12.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:mailman-2.1.15-9.6.12.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.12.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:mailman-2.1.15-9.6.12.1.i586",
"SUSE Linux Enterprise Server 11 SP4-LTSS:mailman-2.1.15-9.6.12.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4-LTSS:mailman-2.1.15-9.6.12.1.s390x",
"SUSE Linux Enterprise Server 11 SP4-LTSS:mailman-2.1.15-9.6.12.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-05-31T06:11:00Z",
"details": "low"
}
],
"title": "CVE-2016-6893"
}
]
}
SUSE-SU-2018:1638-1
Vulnerability from csaf_suse - Published: 2018-06-11 08:41 - Updated: 2018-06-11 08:41Summary
Security update for mailman
Notes
Title of the patch
Security update for mailman
Description of the patch
This update for mailman to version 2.1.15 fixes the following issues:
- CVE-2016-6893: Prevent cross-site request forgery (CSRF) vulnerability in the
user options page that allowed remote attackers to hijack the authentication of
arbitrary users for requests that modify an option (bsc#995352).
- Various other hardenings against CSFR attacks
For details please see https://launchpad.net/mailman/+milestone/2.1.15
Patchnames
slessp4-mailman-13649
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for mailman",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for mailman to version 2.1.15 fixes the following issues:\n\n- CVE-2016-6893: Prevent cross-site request forgery (CSRF) vulnerability in the\n user options page that allowed remote attackers to hijack the authentication of\n arbitrary users for requests that modify an option (bsc#995352).\n- Various other hardenings against CSFR attacks\n\nFor details please see https://launchpad.net/mailman/+milestone/2.1.15\n ",
"title": "Description of the patch"
},
{
"category": "details",
"text": "slessp4-mailman-13649",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_1638-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2018:1638-1",
"url": "https://www.suse.com/support/update/announcement/2018/suse-su-20181638-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2018:1638-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2018-June/004172.html"
},
{
"category": "self",
"summary": "SUSE Bug 995352",
"url": "https://bugzilla.suse.com/995352"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6893 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6893/"
}
],
"title": "Security update for mailman",
"tracking": {
"current_release_date": "2018-06-11T08:41:29Z",
"generator": {
"date": "2018-06-11T08:41:29Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2018:1638-1",
"initial_release_date": "2018-06-11T08:41:29Z",
"revision_history": [
{
"date": "2018-06-11T08:41:29Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.15-9.6.3.1.i586",
"product": {
"name": "mailman-2.1.15-9.6.3.1.i586",
"product_id": "mailman-2.1.15-9.6.3.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.15-9.6.3.1.ia64",
"product": {
"name": "mailman-2.1.15-9.6.3.1.ia64",
"product_id": "mailman-2.1.15-9.6.3.1.ia64"
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.15-9.6.3.1.ppc64",
"product": {
"name": "mailman-2.1.15-9.6.3.1.ppc64",
"product_id": "mailman-2.1.15-9.6.3.1.ppc64"
}
}
],
"category": "architecture",
"name": "ppc64"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.15-9.6.3.1.s390x",
"product": {
"name": "mailman-2.1.15-9.6.3.1.s390x",
"product_id": "mailman-2.1.15-9.6.3.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.15-9.6.3.1.x86_64",
"product": {
"name": "mailman-2.1.15-9.6.3.1.x86_64",
"product_id": "mailman-2.1.15-9.6.3.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 11 SP4",
"product": {
"name": "SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_sles:11:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:11:sp4"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.3.1.i586 as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.3.1.i586"
},
"product_reference": "mailman-2.1.15-9.6.3.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.3.1.ia64 as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.3.1.ia64"
},
"product_reference": "mailman-2.1.15-9.6.3.1.ia64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.3.1.ppc64 as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.3.1.ppc64"
},
"product_reference": "mailman-2.1.15-9.6.3.1.ppc64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.3.1.s390x as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.3.1.s390x"
},
"product_reference": "mailman-2.1.15-9.6.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.3.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.3.1.x86_64"
},
"product_reference": "mailman-2.1.15-9.6.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.3.1.i586 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.3.1.i586"
},
"product_reference": "mailman-2.1.15-9.6.3.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.3.1.ia64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.3.1.ia64"
},
"product_reference": "mailman-2.1.15-9.6.3.1.ia64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.3.1.ppc64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.3.1.ppc64"
},
"product_reference": "mailman-2.1.15-9.6.3.1.ppc64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.3.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.3.1.s390x"
},
"product_reference": "mailman-2.1.15-9.6.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.3.1.x86_64"
},
"product_reference": "mailman-2.1.15-9.6.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-6893",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6893"
}
],
"notes": [
{
"category": "general",
"text": "Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim\u0027s account.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.3.1.i586",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.3.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.3.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.3.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.3.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.3.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.3.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6893",
"url": "https://www.suse.com/security/cve/CVE-2016-6893"
},
{
"category": "external",
"summary": "SUSE Bug 995352 for CVE-2016-6893",
"url": "https://bugzilla.suse.com/995352"
},
{
"category": "external",
"summary": "SUSE Bug 997205 for CVE-2016-6893",
"url": "https://bugzilla.suse.com/997205"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.3.1.i586",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.3.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.3.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.3.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.3.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.3.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.3.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.3.1.i586",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.3.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.3.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.3.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.3.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.3.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.3.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.3.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2018-06-11T08:41:29Z",
"details": "low"
}
],
"title": "CVE-2016-6893"
}
]
}
SUSE-SU-2018:4296-1
Vulnerability from csaf_suse - Published: 2018-12-28 17:38 - Updated: 2018-12-28 17:38Summary
Security update for mailman
Notes
Title of the patch
Security update for mailman
Description of the patch
This update for mailman fixes the following security vulnerabilities:
- Fixed a XSS vulnerability and information leak in user options CGI, which
could be used to execute arbitrary scripts in the user's browser via
specially encoded URLs (bsc#1077358 CVE-2018-5950)
- Fixed a directory traversal vulnerability in MTA transports when using the
recommended Mailman Transport for Exim (bsc#925502 CVE-2015-2775)
- Fixed a XSS vulnerability, which allowed malicious listowners to inject
scripts into the listinfo pages (bsc#1099510 CVE-2018-0618)
- Fixed arbitrary text injection vulnerability in several mailman CGIs
(CVE-2018-13796 bsc#1101288)
- Fixed a CSRF vulnerability on the user options page (CVE-2016-6893 bsc#995352)
Patchnames
SUSE-OpenStack-Cloud-7-2018-3062,SUSE-SLE-SAP-12-SP1-2018-3062,SUSE-SLE-SAP-12-SP2-2018-3062,SUSE-SLE-SERVER-12-2018-3062,SUSE-SLE-SERVER-12-SP1-2018-3062,SUSE-SLE-SERVER-12-SP2-2018-3062,SUSE-SLE-SERVER-12-SP2-BCL-2018-3062,SUSE-SLE-SERVER-12-SP3-2018-3062,SUSE-SLE-SERVER-12-SP4-2018-3062,SUSE-Storage-4-2018-3062
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for mailman",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for mailman fixes the following security vulnerabilities:\n\n- Fixed a XSS vulnerability and information leak in user options CGI, which\n could be used to execute arbitrary scripts in the user\u0027s browser via\n specially encoded URLs (bsc#1077358 CVE-2018-5950)\n- Fixed a directory traversal vulnerability in MTA transports when using the\n recommended Mailman Transport for Exim (bsc#925502 CVE-2015-2775)\n- Fixed a XSS vulnerability, which allowed malicious listowners to inject\n scripts into the listinfo pages (bsc#1099510 CVE-2018-0618)\n- Fixed arbitrary text injection vulnerability in several mailman CGIs\n (CVE-2018-13796 bsc#1101288)\n- Fixed a CSRF vulnerability on the user options page (CVE-2016-6893 bsc#995352)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-OpenStack-Cloud-7-2018-3062,SUSE-SLE-SAP-12-SP1-2018-3062,SUSE-SLE-SAP-12-SP2-2018-3062,SUSE-SLE-SERVER-12-2018-3062,SUSE-SLE-SERVER-12-SP1-2018-3062,SUSE-SLE-SERVER-12-SP2-2018-3062,SUSE-SLE-SERVER-12-SP2-BCL-2018-3062,SUSE-SLE-SERVER-12-SP3-2018-3062,SUSE-SLE-SERVER-12-SP4-2018-3062,SUSE-Storage-4-2018-3062",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_4296-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2018:4296-1",
"url": "https://www.suse.com/support/update/announcement/2018/suse-su-20184296-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2018:4296-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2018-December/005005.html"
},
{
"category": "self",
"summary": "SUSE Bug 1077358",
"url": "https://bugzilla.suse.com/1077358"
},
{
"category": "self",
"summary": "SUSE Bug 1099510",
"url": "https://bugzilla.suse.com/1099510"
},
{
"category": "self",
"summary": "SUSE Bug 1101288",
"url": "https://bugzilla.suse.com/1101288"
},
{
"category": "self",
"summary": "SUSE Bug 925502",
"url": "https://bugzilla.suse.com/925502"
},
{
"category": "self",
"summary": "SUSE Bug 995352",
"url": "https://bugzilla.suse.com/995352"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-2775 page",
"url": "https://www.suse.com/security/cve/CVE-2015-2775/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6893 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6893/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-0618 page",
"url": "https://www.suse.com/security/cve/CVE-2018-0618/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-13796 page",
"url": "https://www.suse.com/security/cve/CVE-2018-13796/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-5950 page",
"url": "https://www.suse.com/security/cve/CVE-2018-5950/"
}
],
"title": "Security update for mailman",
"tracking": {
"current_release_date": "2018-12-28T17:38:42Z",
"generator": {
"date": "2018-12-28T17:38:42Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2018:4296-1",
"initial_release_date": "2018-12-28T17:38:42Z",
"revision_history": [
{
"date": "2018-12-28T17:38:42Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.17-3.3.3.ppc64le",
"product": {
"name": "mailman-2.1.17-3.3.3.ppc64le",
"product_id": "mailman-2.1.17-3.3.3.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.17-3.3.3.s390x",
"product": {
"name": "mailman-2.1.17-3.3.3.s390x",
"product_id": "mailman-2.1.17-3.3.3.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.17-3.3.3.x86_64",
"product": {
"name": "mailman-2.1.17-3.3.3.x86_64",
"product_id": "mailman-2.1.17-3.3.3.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE OpenStack Cloud 7",
"product": {
"name": "SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-openstack-cloud:7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 12-LTSS",
"product_id": "SUSE Linux Enterprise Server 12-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:12"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP1-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP1-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:12:sp1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP2-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:12:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP2-BCL",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP2-BCL",
"product_id": "SUSE Linux Enterprise Server 12 SP2-BCL",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-bcl:12:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP3",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP3",
"product_id": "SUSE Linux Enterprise Server 12 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP4",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP4",
"product_id": "SUSE Linux Enterprise Server 12 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Enterprise Storage 4",
"product": {
"name": "SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:ses:4"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.s390x as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x"
},
"product_reference": "mailman-2.1.17-3.3.3.s390x",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64"
},
"product_reference": "mailman-2.1.17-3.3.3.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le"
},
"product_reference": "mailman-2.1.17-3.3.3.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64"
},
"product_reference": "mailman-2.1.17-3.3.3.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le"
},
"product_reference": "mailman-2.1.17-3.3.3.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64"
},
"product_reference": "mailman-2.1.17-3.3.3.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.ppc64le as component of SUSE Linux Enterprise Server 12-LTSS",
"product_id": "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le"
},
"product_reference": "mailman-2.1.17-3.3.3.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.s390x as component of SUSE Linux Enterprise Server 12-LTSS",
"product_id": "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x"
},
"product_reference": "mailman-2.1.17-3.3.3.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
"product_id": "SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64"
},
"product_reference": "mailman-2.1.17-3.3.3.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.ppc64le as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le"
},
"product_reference": "mailman-2.1.17-3.3.3.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.s390x as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x"
},
"product_reference": "mailman-2.1.17-3.3.3.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64"
},
"product_reference": "mailman-2.1.17-3.3.3.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.ppc64le as component of SUSE Linux Enterprise Server 12 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le"
},
"product_reference": "mailman-2.1.17-3.3.3.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.s390x as component of SUSE Linux Enterprise Server 12 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x"
},
"product_reference": "mailman-2.1.17-3.3.3.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-LTSS",
"product_id": "SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64"
},
"product_reference": "mailman-2.1.17-3.3.3.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Linux Enterprise Server 12 SP2-BCL",
"product_id": "SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64"
},
"product_reference": "mailman-2.1.17-3.3.3.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2-BCL"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.ppc64le as component of SUSE Linux Enterprise Server 12 SP3",
"product_id": "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le"
},
"product_reference": "mailman-2.1.17-3.3.3.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.s390x as component of SUSE Linux Enterprise Server 12 SP3",
"product_id": "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x"
},
"product_reference": "mailman-2.1.17-3.3.3.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Linux Enterprise Server 12 SP3",
"product_id": "SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64"
},
"product_reference": "mailman-2.1.17-3.3.3.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le"
},
"product_reference": "mailman-2.1.17-3.3.3.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x"
},
"product_reference": "mailman-2.1.17-3.3.3.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP3",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64"
},
"product_reference": "mailman-2.1.17-3.3.3.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.ppc64le as component of SUSE Linux Enterprise Server 12 SP4",
"product_id": "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le"
},
"product_reference": "mailman-2.1.17-3.3.3.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.s390x as component of SUSE Linux Enterprise Server 12 SP4",
"product_id": "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x"
},
"product_reference": "mailman-2.1.17-3.3.3.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Linux Enterprise Server 12 SP4",
"product_id": "SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64"
},
"product_reference": "mailman-2.1.17-3.3.3.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le"
},
"product_reference": "mailman-2.1.17-3.3.3.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x"
},
"product_reference": "mailman-2.1.17-3.3.3.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64"
},
"product_reference": "mailman-2.1.17-3.3.3.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.17-3.3.3.x86_64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64"
},
"product_reference": "mailman-2.1.17-3.3.3.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-2775",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-2775"
}
],
"notes": [
{
"category": "general",
"text": "Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-2775",
"url": "https://www.suse.com/security/cve/CVE-2015-2775"
},
{
"category": "external",
"summary": "SUSE Bug 925502 for CVE-2015-2775",
"url": "https://bugzilla.suse.com/925502"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2018-12-28T17:38:42Z",
"details": "moderate"
}
],
"title": "CVE-2015-2775"
},
{
"cve": "CVE-2016-6893",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6893"
}
],
"notes": [
{
"category": "general",
"text": "Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim\u0027s account.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6893",
"url": "https://www.suse.com/security/cve/CVE-2016-6893"
},
{
"category": "external",
"summary": "SUSE Bug 995352 for CVE-2016-6893",
"url": "https://bugzilla.suse.com/995352"
},
{
"category": "external",
"summary": "SUSE Bug 997205 for CVE-2016-6893",
"url": "https://bugzilla.suse.com/997205"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2018-12-28T17:38:42Z",
"details": "low"
}
],
"title": "CVE-2016-6893"
},
{
"cve": "CVE-2018-0618",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-0618"
}
],
"notes": [
{
"category": "general",
"text": "Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-0618",
"url": "https://www.suse.com/security/cve/CVE-2018-0618"
},
{
"category": "external",
"summary": "SUSE Bug 1099510 for CVE-2018-0618",
"url": "https://bugzilla.suse.com/1099510"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2018-12-28T17:38:42Z",
"details": "moderate"
}
],
"title": "CVE-2018-0618"
},
{
"cve": "CVE-2018-13796",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-13796"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-13796",
"url": "https://www.suse.com/security/cve/CVE-2018-13796"
},
{
"category": "external",
"summary": "SUSE Bug 1101288 for CVE-2018-13796",
"url": "https://bugzilla.suse.com/1101288"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2018-12-28T17:38:42Z",
"details": "moderate"
}
],
"title": "CVE-2018-13796"
},
{
"cve": "CVE-2018-5950",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-5950"
}
],
"notes": [
{
"category": "general",
"text": "Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-5950",
"url": "https://www.suse.com/security/cve/CVE-2018-5950"
},
{
"category": "external",
"summary": "SUSE Bug 1077358 for CVE-2018-5950",
"url": "https://bugzilla.suse.com/1077358"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Enterprise Storage 4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP1-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-BCL:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP2-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server 12-LTSS:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP3:mailman-2.1.17-3.3.3.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP4:mailman-2.1.17-3.3.3.x86_64",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.s390x",
"SUSE OpenStack Cloud 7:mailman-2.1.17-3.3.3.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2018-12-28T17:38:42Z",
"details": "moderate"
}
],
"title": "CVE-2018-5950"
}
]
}
SUSE-SU-2019:13924-1
Vulnerability from csaf_suse - Published: 2019-01-04 10:03 - Updated: 2019-01-04 10:03Summary
Security update for mailman
Notes
Title of the patch
Security update for mailman
Description of the patch
This update for mailman fixes the following issues:
- Fixed a XSS vulnerability and information leak in user options CGI, which
could be used to execute arbitrary scripts in the user's browser via
specially encoded URLs (bsc#1077358 CVE-2018-5950)
- Fixed a directory traversal vulnerability in MTA transports when using the
recommended Mailman Transport for Exim (bsc#925502 CVE-2015-2775)
- Fixed a XSS vulnerability, which allowed malicious listowners to inject
scripts into the listinfo pages (bsc#1099510 CVE-2018-0618)
- Fixed arbitrary text injection vulnerability in several mailman CGIs
(CVE-2018-13796 bsc#1101288)
- Fixed a CSRF vulnerability on the user options page (CVE-2016-6893 bsc#995352)
Patchnames
sleposp3-mailman-13924,slessp3-mailman-13924,slessp4-mailman-13924
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for mailman",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for mailman fixes the following issues:\n\n- Fixed a XSS vulnerability and information leak in user options CGI, which\n could be used to execute arbitrary scripts in the user\u0027s browser via\n specially encoded URLs (bsc#1077358 CVE-2018-5950)\n- Fixed a directory traversal vulnerability in MTA transports when using the\n recommended Mailman Transport for Exim (bsc#925502 CVE-2015-2775)\n- Fixed a XSS vulnerability, which allowed malicious listowners to inject\n scripts into the listinfo pages (bsc#1099510 CVE-2018-0618)\n- Fixed arbitrary text injection vulnerability in several mailman CGIs\n (CVE-2018-13796 bsc#1101288)\n- Fixed a CSRF vulnerability on the user options page (CVE-2016-6893 bsc#995352)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "sleposp3-mailman-13924,slessp3-mailman-13924,slessp4-mailman-13924",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_13924-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2019:13924-1",
"url": "https://www.suse.com/support/update/announcement/2019/suse-su-201913924-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2019:13924-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2019-January/005015.html"
},
{
"category": "self",
"summary": "SUSE Bug 1077358",
"url": "https://bugzilla.suse.com/1077358"
},
{
"category": "self",
"summary": "SUSE Bug 1099510",
"url": "https://bugzilla.suse.com/1099510"
},
{
"category": "self",
"summary": "SUSE Bug 1101288",
"url": "https://bugzilla.suse.com/1101288"
},
{
"category": "self",
"summary": "SUSE Bug 925502",
"url": "https://bugzilla.suse.com/925502"
},
{
"category": "self",
"summary": "SUSE Bug 995352",
"url": "https://bugzilla.suse.com/995352"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-2775 page",
"url": "https://www.suse.com/security/cve/CVE-2015-2775/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6893 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6893/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-0618 page",
"url": "https://www.suse.com/security/cve/CVE-2018-0618/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-13796 page",
"url": "https://www.suse.com/security/cve/CVE-2018-13796/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-5950 page",
"url": "https://www.suse.com/security/cve/CVE-2018-5950/"
}
],
"title": "Security update for mailman",
"tracking": {
"current_release_date": "2019-01-04T10:03:11Z",
"generator": {
"date": "2019-01-04T10:03:11Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2019:13924-1",
"initial_release_date": "2019-01-04T10:03:11Z",
"revision_history": [
{
"date": "2019-01-04T10:03:11Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.15-9.6.6.1.i586",
"product": {
"name": "mailman-2.1.15-9.6.6.1.i586",
"product_id": "mailman-2.1.15-9.6.6.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.15-9.6.6.1.ia64",
"product": {
"name": "mailman-2.1.15-9.6.6.1.ia64",
"product_id": "mailman-2.1.15-9.6.6.1.ia64"
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.15-9.6.6.1.ppc64",
"product": {
"name": "mailman-2.1.15-9.6.6.1.ppc64",
"product_id": "mailman-2.1.15-9.6.6.1.ppc64"
}
}
],
"category": "architecture",
"name": "ppc64"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.15-9.6.6.1.s390x",
"product": {
"name": "mailman-2.1.15-9.6.6.1.s390x",
"product_id": "mailman-2.1.15-9.6.6.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.15-9.6.6.1.x86_64",
"product": {
"name": "mailman-2.1.15-9.6.6.1.x86_64",
"product_id": "mailman-2.1.15-9.6.6.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Point of Sale 11 SP3",
"product": {
"name": "SUSE Linux Enterprise Point of Sale 11 SP3",
"product_id": "SUSE Linux Enterprise Point of Sale 11 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-pos:11:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 11 SP3-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 11 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP3-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_sles_ltss:11:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product": {
"name": "SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product_id": "SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:11:sp3:teradata"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 11 SP4",
"product": {
"name": "SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_sles:11:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:11:sp4"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.6.1.i586 as component of SUSE Linux Enterprise Point of Sale 11 SP3",
"product_id": "SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586"
},
"product_reference": "mailman-2.1.15-9.6.6.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Point of Sale 11 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.6.1.i586 as component of SUSE Linux Enterprise Server 11 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586"
},
"product_reference": "mailman-2.1.15-9.6.6.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.6.1.s390x as component of SUSE Linux Enterprise Server 11 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x"
},
"product_reference": "mailman-2.1.15-9.6.6.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.6.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP3-LTSS",
"product_id": "SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64"
},
"product_reference": "mailman-2.1.15-9.6.6.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.6.1.i586 as component of SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product_id": "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586"
},
"product_reference": "mailman-2.1.15-9.6.6.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-TERADATA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.6.1.s390x as component of SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product_id": "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x"
},
"product_reference": "mailman-2.1.15-9.6.6.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-TERADATA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.6.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP3-TERADATA",
"product_id": "SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64"
},
"product_reference": "mailman-2.1.15-9.6.6.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP3-TERADATA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.6.1.i586 as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586"
},
"product_reference": "mailman-2.1.15-9.6.6.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.6.1.ia64 as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64"
},
"product_reference": "mailman-2.1.15-9.6.6.1.ia64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.6.1.ppc64 as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64"
},
"product_reference": "mailman-2.1.15-9.6.6.1.ppc64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.6.1.s390x as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x"
},
"product_reference": "mailman-2.1.15-9.6.6.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.6.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64"
},
"product_reference": "mailman-2.1.15-9.6.6.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.6.1.i586 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586"
},
"product_reference": "mailman-2.1.15-9.6.6.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.6.1.ia64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64"
},
"product_reference": "mailman-2.1.15-9.6.6.1.ia64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.6.1.ppc64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64"
},
"product_reference": "mailman-2.1.15-9.6.6.1.ppc64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.6.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x"
},
"product_reference": "mailman-2.1.15-9.6.6.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.15-9.6.6.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64"
},
"product_reference": "mailman-2.1.15-9.6.6.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2015-2775",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-2775"
}
],
"notes": [
{
"category": "general",
"text": "Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-2775",
"url": "https://www.suse.com/security/cve/CVE-2015-2775"
},
{
"category": "external",
"summary": "SUSE Bug 925502 for CVE-2015-2775",
"url": "https://bugzilla.suse.com/925502"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-01-04T10:03:11Z",
"details": "moderate"
}
],
"title": "CVE-2015-2775"
},
{
"cve": "CVE-2016-6893",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6893"
}
],
"notes": [
{
"category": "general",
"text": "Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim\u0027s account.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6893",
"url": "https://www.suse.com/security/cve/CVE-2016-6893"
},
{
"category": "external",
"summary": "SUSE Bug 995352 for CVE-2016-6893",
"url": "https://bugzilla.suse.com/995352"
},
{
"category": "external",
"summary": "SUSE Bug 997205 for CVE-2016-6893",
"url": "https://bugzilla.suse.com/997205"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-01-04T10:03:11Z",
"details": "low"
}
],
"title": "CVE-2016-6893"
},
{
"cve": "CVE-2018-0618",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-0618"
}
],
"notes": [
{
"category": "general",
"text": "Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-0618",
"url": "https://www.suse.com/security/cve/CVE-2018-0618"
},
{
"category": "external",
"summary": "SUSE Bug 1099510 for CVE-2018-0618",
"url": "https://bugzilla.suse.com/1099510"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-01-04T10:03:11Z",
"details": "moderate"
}
],
"title": "CVE-2018-0618"
},
{
"cve": "CVE-2018-13796",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-13796"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-13796",
"url": "https://www.suse.com/security/cve/CVE-2018-13796"
},
{
"category": "external",
"summary": "SUSE Bug 1101288 for CVE-2018-13796",
"url": "https://bugzilla.suse.com/1101288"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-01-04T10:03:11Z",
"details": "moderate"
}
],
"title": "CVE-2018-13796"
},
{
"cve": "CVE-2018-5950",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-5950"
}
],
"notes": [
{
"category": "general",
"text": "Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-5950",
"url": "https://www.suse.com/security/cve/CVE-2018-5950"
},
{
"category": "external",
"summary": "SUSE Bug 1077358 for CVE-2018-5950",
"url": "https://bugzilla.suse.com/1077358"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-LTSS:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP3-TERADATA:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:mailman-2.1.15-9.6.6.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:mailman-2.1.15-9.6.6.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-01-04T10:03:11Z",
"details": "moderate"
}
],
"title": "CVE-2018-5950"
}
]
}
OPENSUSE-SU-2024:10215-1
Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00Summary
mailman-2.1.23-1.2 on GA media
Notes
Title of the patch
mailman-2.1.23-1.2 on GA media
Description of the patch
These are all security issues fixed in the mailman-2.1.23-1.2 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-10215
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "mailman-2.1.23-1.2 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the mailman-2.1.23-1.2 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-10215",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10215-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2011-0707 page",
"url": "https://www.suse.com/security/cve/CVE-2011-0707/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2015-2775 page",
"url": "https://www.suse.com/security/cve/CVE-2015-2775/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6893 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6893/"
}
],
"title": "mailman-2.1.23-1.2 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:10215-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.23-1.2.aarch64",
"product": {
"name": "mailman-2.1.23-1.2.aarch64",
"product_id": "mailman-2.1.23-1.2.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.23-1.2.ppc64le",
"product": {
"name": "mailman-2.1.23-1.2.ppc64le",
"product_id": "mailman-2.1.23-1.2.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.23-1.2.s390x",
"product": {
"name": "mailman-2.1.23-1.2.s390x",
"product_id": "mailman-2.1.23-1.2.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "mailman-2.1.23-1.2.x86_64",
"product": {
"name": "mailman-2.1.23-1.2.x86_64",
"product_id": "mailman-2.1.23-1.2.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.23-1.2.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:mailman-2.1.23-1.2.aarch64"
},
"product_reference": "mailman-2.1.23-1.2.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.23-1.2.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:mailman-2.1.23-1.2.ppc64le"
},
"product_reference": "mailman-2.1.23-1.2.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.23-1.2.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:mailman-2.1.23-1.2.s390x"
},
"product_reference": "mailman-2.1.23-1.2.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mailman-2.1.23-1.2.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:mailman-2.1.23-1.2.x86_64"
},
"product_reference": "mailman-2.1.23-1.2.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2011-0707",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2011-0707"
}
],
"notes": [
{
"category": "general",
"text": "Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) username field in a confirmation message.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:mailman-2.1.23-1.2.aarch64",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.ppc64le",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.s390x",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2011-0707",
"url": "https://www.suse.com/security/cve/CVE-2011-0707"
},
{
"category": "external",
"summary": "SUSE Bug 671745 for CVE-2011-0707",
"url": "https://bugzilla.suse.com/671745"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:mailman-2.1.23-1.2.aarch64",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.ppc64le",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.s390x",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2011-0707"
},
{
"cve": "CVE-2015-2775",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2015-2775"
}
],
"notes": [
{
"category": "general",
"text": "Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:mailman-2.1.23-1.2.aarch64",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.ppc64le",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.s390x",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2015-2775",
"url": "https://www.suse.com/security/cve/CVE-2015-2775"
},
{
"category": "external",
"summary": "SUSE Bug 925502 for CVE-2015-2775",
"url": "https://bugzilla.suse.com/925502"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:mailman-2.1.23-1.2.aarch64",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.ppc64le",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.s390x",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:mailman-2.1.23-1.2.aarch64",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.ppc64le",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.s390x",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2015-2775"
},
{
"cve": "CVE-2016-6893",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6893"
}
],
"notes": [
{
"category": "general",
"text": "Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim\u0027s account.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:mailman-2.1.23-1.2.aarch64",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.ppc64le",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.s390x",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6893",
"url": "https://www.suse.com/security/cve/CVE-2016-6893"
},
{
"category": "external",
"summary": "SUSE Bug 995352 for CVE-2016-6893",
"url": "https://bugzilla.suse.com/995352"
},
{
"category": "external",
"summary": "SUSE Bug 997205 for CVE-2016-6893",
"url": "https://bugzilla.suse.com/997205"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:mailman-2.1.23-1.2.aarch64",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.ppc64le",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.s390x",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:mailman-2.1.23-1.2.aarch64",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.ppc64le",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.s390x",
"openSUSE Tumbleweed:mailman-2.1.23-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2016-6893"
}
]
}
GSD-2016-6893
Vulnerability from gsd - Updated: 2023-12-13 01:21Details
Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2016-6893",
"description": "Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim\u0027s account.",
"id": "GSD-2016-6893",
"references": [
"https://www.suse.com/security/cve/CVE-2016-6893.html",
"https://www.debian.org/security/2016/dsa-3668",
"https://access.redhat.com/errata/RHSA-2021:4913",
"https://ubuntu.com/security/CVE-2016-6893",
"https://advisories.mageia.org/CVE-2016-6893.html",
"https://alas.aws.amazon.com/cve/html/CVE-2016-6893.html",
"https://linux.oracle.com/cve/CVE-2016-6893.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2016-6893"
],
"details": "Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim\u0027s account.",
"id": "GSD-2016-6893",
"modified": "2023-12-13T01:21:23.036752Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6893",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim\u0027s account."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "DSA-3668",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3668"
},
{
"name": "https://bugs.launchpad.net/bugs/1614841",
"refsource": "CONFIRM",
"url": "https://bugs.launchpad.net/bugs/1614841"
},
{
"name": "92731",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92731"
},
{
"name": "1036728",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1036728"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.10b3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.10b4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.10:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.13:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.16:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.16:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.18:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.19:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.19:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.23:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.10b1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.12:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.12:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.15:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.18:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.18:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.21:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.22:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.11:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.14:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.18-1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.21:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.11:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.14-1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.16:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.19:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:gnu:mailman:2.1.19:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-6893"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim\u0027s account."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugs.launchpad.net/bugs/1614841",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking"
],
"url": "https://bugs.launchpad.net/bugs/1614841"
},
{
"name": "92731",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/92731"
},
{
"name": "DSA-3668",
"refsource": "DEBIAN",
"tags": [],
"url": "http://www.debian.org/security/2016/dsa-3668"
},
{
"name": "1036728",
"refsource": "SECTRACK",
"tags": [],
"url": "http://www.securitytracker.com/id/1036728"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": true
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
},
"lastModifiedDate": "2017-08-13T01:29Z",
"publishedDate": "2016-09-02T14:59Z"
}
}
}
GHSA-46P3-9VJV-GQ2W
Vulnerability from github – Published: 2022-05-17 02:14 – Updated: 2022-05-17 02:14
VLAI?
Details
Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account.
Severity ?
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2016-6893"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-09-02T14:59:00Z",
"severity": "HIGH"
},
"details": "Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim\u0027s account.",
"id": "GHSA-46p3-9vjv-gq2w",
"modified": "2022-05-17T02:14:38Z",
"published": "2022-05-17T02:14:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6893"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/bugs/1614841"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3668"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/92731"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1036728"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
FKIE_CVE-2016-6893
Vulnerability from fkie_nvd - Published: 2016-09-02 14:59 - Updated: 2025-04-12 10:46
Severity ?
Summary
Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| gnu | mailman | 2.1 | |
| gnu | mailman | 2.1.1 | |
| gnu | mailman | 2.1.2 | |
| gnu | mailman | 2.1.3 | |
| gnu | mailman | 2.1.4 | |
| gnu | mailman | 2.1.5 | |
| gnu | mailman | 2.1.6 | |
| gnu | mailman | 2.1.8 | |
| gnu | mailman | 2.1.9 | |
| gnu | mailman | 2.1.10 | |
| gnu | mailman | 2.1.10 | |
| gnu | mailman | 2.1.10b1 | |
| gnu | mailman | 2.1.10b3 | |
| gnu | mailman | 2.1.10b4 | |
| gnu | mailman | 2.1.11 | |
| gnu | mailman | 2.1.11 | |
| gnu | mailman | 2.1.11 | |
| gnu | mailman | 2.1.12 | |
| gnu | mailman | 2.1.12 | |
| gnu | mailman | 2.1.12 | |
| gnu | mailman | 2.1.13 | |
| gnu | mailman | 2.1.13 | |
| gnu | mailman | 2.1.14 | |
| gnu | mailman | 2.1.14 | |
| gnu | mailman | 2.1.14-1 | |
| gnu | mailman | 2.1.15 | |
| gnu | mailman | 2.1.15 | |
| gnu | mailman | 2.1.16 | |
| gnu | mailman | 2.1.16 | |
| gnu | mailman | 2.1.16 | |
| gnu | mailman | 2.1.16 | |
| gnu | mailman | 2.1.17 | |
| gnu | mailman | 2.1.18 | |
| gnu | mailman | 2.1.18 | |
| gnu | mailman | 2.1.18 | |
| gnu | mailman | 2.1.18 | |
| gnu | mailman | 2.1.18-1 | |
| gnu | mailman | 2.1.19 | |
| gnu | mailman | 2.1.19 | |
| gnu | mailman | 2.1.19 | |
| gnu | mailman | 2.1.19 | |
| gnu | mailman | 2.1.20 | |
| gnu | mailman | 2.1.21 | |
| gnu | mailman | 2.1.21 | |
| gnu | mailman | 2.1.22 | |
| gnu | mailman | 2.1.23 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B1D6A976-FFEA-4DB6-B002-8036E778C78E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B8894855-E303-4B55-B3BC-DCBE3A0AB703",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0B1500D8-952A-46C6-920C-096760C36A43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "503D7346-4891-40B1-A0CD-0FACC5359431",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "643610C6-99A9-43C9-A8FC-463A244C08DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "45C53260-503F-4934-B1FE-9FACD8E0EE66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A34CBFC5-CB18-4FE4-9B4D-F3280CBCCD6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "E2571330-3239-469E-883D-8994257D0C55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "5F27323B-6B10-4941-B20B-187562797D44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "890FEDE2-474A-4870-9165-CAD39BC6D318",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D4FFE8F2-B665-41F1-B4C5-E7C66BE91E24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.10b1:*:*:*:*:*:*:*",
"matchCriteriaId": "8C08F313-30E9-4B9E-BA5A-4910DD5E155C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.10b3:*:*:*:*:*:*:*",
"matchCriteriaId": "D9B09DFC-A238-49CA-9DB8-F4052775BF3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.10b4:*:*:*:*:*:*:*",
"matchCriteriaId": "C219D531-3E3A-4B85-B3A6-8A4335E86AB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "A1C7EEDB-5794-419A-8E61-137DB76A4E15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.11:rc1:*:*:*:*:*:*",
"matchCriteriaId": "C1FC55D7-3857-4614-82FC-5266A3BD8FE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.11:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A64FECFD-F6BF-49C1-926C-41868787378C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "5F7A3B58-4038-41AE-A42E-BE743A14D5A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.12:rc1:*:*:*:*:*:*",
"matchCriteriaId": "2C3215CB-7146-49D3-B350-A07E0C9FB04D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.12:rc2:*:*:*:*:*:*",
"matchCriteriaId": "800F3CE3-CEE2-4C63-B0DD-F9F72E9F1B71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "2019E834-DFF4-4C9A-82D1-E768EA8934EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.13:rc1:*:*:*:*:*:*",
"matchCriteriaId": "E3D1CC02-7D5F-41CB-A881-A82A13CE9EE5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "11010D5F-AA02-45EC-B007-47BF9194250B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.14:rc1:*:*:*:*:*:*",
"matchCriteriaId": "A677EC3D-A08A-44B8-B7E1-F229F515F407",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.14-1:*:*:*:*:*:*:*",
"matchCriteriaId": "876E65AB-6D2E-41C2-899E-7D5EE176F877",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.15:*:*:*:*:*:*:*",
"matchCriteriaId": "7985A5B3-0473-426D-9F8D-63B81C7D1177",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.15:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6B211D97-5316-4EB1-999D-26C53708F200",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.16:*:*:*:*:*:*:*",
"matchCriteriaId": "F6AC4D1E-B92F-400A-8B73-CB99E5825A05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "5BB702F4-324D-4B87-9590-22CD2465A708",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.16:rc2:*:*:*:*:*:*",
"matchCriteriaId": "47B47F16-4E68-4DB2-9C61-DBABB75C7A99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.16:rc3:*:*:*:*:*:*",
"matchCriteriaId": "11931F41-6B65-4C1B-9A82-8F89F093E9AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.17:*:*:*:*:*:*:*",
"matchCriteriaId": "59A972C3-06C4-4DED-825C-B1931B35E135",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.18:*:*:*:*:*:*:*",
"matchCriteriaId": "6BB3C5C8-98AC-4BC3-A06E-6F2920CA951B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.18:rc1:*:*:*:*:*:*",
"matchCriteriaId": "1C3BC472-4428-4786-A3AA-390C66553DC0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.18:rc2:*:*:*:*:*:*",
"matchCriteriaId": "69B95EB8-6D8B-4342-A6A8-472BF1190A87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.18:rc3:*:*:*:*:*:*",
"matchCriteriaId": "011CD4BF-FE51-40A7-B457-884DDF3C7FFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.18-1:*:*:*:*:*:*:*",
"matchCriteriaId": "9C2DA8DD-77C1-44A0-9A49-FB1CEE26CB1E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.19:*:*:*:*:*:*:*",
"matchCriteriaId": "68C51AFA-3C45-48A2-8ADC-514BF5374413",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.19:rc1:*:*:*:*:*:*",
"matchCriteriaId": "BF11D5FD-FCD5-4147-876C-09980D05152C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.19:rc2:*:*:*:*:*:*",
"matchCriteriaId": "503671C5-1F2A-4676-8D58-86C2D01405E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.19:rc3:*:*:*:*:*:*",
"matchCriteriaId": "5154BCB6-2216-433E-BC77-B862490545F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.20:*:*:*:*:*:*:*",
"matchCriteriaId": "E73970DC-7F70-437E-A669-B0EE6F4629AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.21:*:*:*:*:*:*:*",
"matchCriteriaId": "13081A16-D625-4AD1-9493-AFA5126269C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.21:rc2:*:*:*:*:*:*",
"matchCriteriaId": "F6F40EE5-9E50-4703-9151-4640B11C78A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.22:*:*:*:*:*:*:*",
"matchCriteriaId": "51028759-33CD-4C80-A534-B46E62C03F4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:gnu:mailman:2.1.23:*:*:*:*:*:*:*",
"matchCriteriaId": "683F421B-C986-4572-9612-1635AF7DD084",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim\u0027s account."
},
{
"lang": "es",
"value": "Vulnerabilidad de CSRF en la p\u00e1gina de opciones de usuario en GNU Mailman 2.1.x en versiones anteriores a 2.1.23 permite a atacantes remotos secuestrar la autenticaci\u00f3n de usuarios arbitrarios para peticiones que modifican una opci\u00f3n, tal como se demuestra ganando acceso a las credenciales de una cuenta de una v\u00edctima."
}
],
"id": "CVE-2016-6893",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-09-02T14:59:09.283",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2016/dsa-3668"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/92731"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id/1036728"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking"
],
"url": "https://bugs.launchpad.net/bugs/1614841"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2016/dsa-3668"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/92731"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1036728"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking"
],
"url": "https://bugs.launchpad.net/bugs/1614841"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CNVD-2016-07107
Vulnerability from cnvd - Published: 2016-09-05
VLAI Severity ?
Title
GNU Mailman跨站请求伪造漏洞
Description
GNU Mailman是一款应用于GNU项目用来管理电子邮件列表的软件。
GNU Mailman跨站请求伪造漏洞，该漏洞产生的原因是未能正确校验HTTP请求，允许远程攻击者利用漏洞执行某些未授权操作，获取敏感信息。
Severity
中
Patch Name
GNU Mailman跨站请求伪造漏洞的补丁
Patch Description
GNU Mailman是一款应用于GNU项目用来管理电子邮件列表的软件。
GNU Mailman跨站请求伪造漏洞，该漏洞产生的原因是未能正确校验HTTP请求，允许远程攻击者利用漏洞执行某些未授权操作，获取敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
目前厂商已经发布了补丁升级程序，请广大用户联系官网及时下载： http://www.gnu.org/software/mailman/mailman.html
Reference
http://www.securityfocus.com/bid/92731
Impacted products
| Name | Gnu Mailman 2.1.*，<2.1.23 |
|---|
{
"bids": {
"bid": {
"bidNumber": "92731"
}
},
"cves": {
"cve": {
"cveNumber": "CVE-2016-6893"
}
},
"description": "GNU Mailman\u662f\u4e00\u6b3e\u5e94\u7528\u4e8eGNU\u9879\u76ee\u7528\u6765\u7ba1\u7406\u7535\u5b50\u90ae\u4ef6\u5217\u8868\u7684\u8f6f\u4ef6\u3002\r\n\r\nGNU Mailman\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u4ea7\u751f\u7684\u539f\u56e0\u662f\u672a\u80fd\u6b63\u786e\u6821\u9a8cHTTP\u8bf7\u6c42\uff0c\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u6267\u884c\u67d0\u4e9b\u672a\u6388\u6743\u64cd\u4f5c\uff0c\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
"discovererName": "GNU",
"formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u8865\u4e01\u5347\u7ea7\u7a0b\u5e8f\uff0c\u8bf7\u5e7f\u5927\u7528\u6237\u8054\u7cfb\u5b98\u7f51\u53ca\u65f6\u4e0b\u8f7d\uff1a\r\nhttp://www.gnu.org/software/mailman/mailman.html",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2016-07107",
"openTime": "2016-09-05",
"patchDescription": "GNU Mailman\u662f\u4e00\u6b3e\u5e94\u7528\u4e8eGNU\u9879\u76ee\u7528\u6765\u7ba1\u7406\u7535\u5b50\u90ae\u4ef6\u5217\u8868\u7684\u8f6f\u4ef6\u3002\r\n\r\nGNU Mailman\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u4ea7\u751f\u7684\u539f\u56e0\u662f\u672a\u80fd\u6b63\u786e\u6821\u9a8cHTTP\u8bf7\u6c42\uff0c\u5141\u8bb8\u8fdc\u7a0b\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u6267\u884c\u67d0\u4e9b\u672a\u6388\u6743\u64cd\u4f5c\uff0c\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "GNU Mailman\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": "Gnu Mailman 2.1.*\uff0c\u003c2.1.23"
},
"referenceLink": "http://www.securityfocus.com/bid/92731",
"serverity": "\u4e2d",
"submitTime": "2016-09-03",
"title": "GNU Mailman\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…