Red Hat Security AdvisoryRHSA-2021:4915
mailman:2.1 security update
Released 2021-12-02 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v.8.4) mailman-3:2.1.29-11.module+el8.4.0+13467+746daedf.2.aarch64::mailman:2.1, mailman-3:2.1.29-11.module+el8.4.0+13467+746daedf.2.ppc64le::mailman:2.1, mailman-3:2.1.29-11.module+el8.4.0+13467+746daedf.2.s390x::mailman:2.1 +2
Fixes 1 record
Priority LOW 39
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00757 · Published 2021-12-02 · Partial fix · 2.1.38 CWE-352
