Red Hat Security AdvisoryRHSA-2021:5080
mailman:2.1 security update
Released 2021-12-13 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v. 8.2) mailman-3:2.1.29-6.module+el8.2.0+13543+86b2c701.aarch64::mailman:2.1, mailman-3:2.1.29-6.module+el8.2.0+13543+86b2c701.ppc64le::mailman:2.1, mailman-3:2.1.29-6.module+el8.2.0+13543+86b2c701.s390x::mailman:2.1 +2
Fixes 1 record
Priority LOW 39
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00757 · Published 2021-12-02 · Partial fix · 2.1.38 CWE-352
