Red Hat Security AdvisoryRHSA-2021:5081
mailman:2.1 security update
Released 2021-12-13 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream E4S (v. 8.1) mailman-3:2.1.29-5.module+el8.1.0+13542+e9b93c88.ppc64le::mailman:2.1, mailman-3:2.1.29-5.module+el8.1.0+13542+e9b93c88.src::mailman:2.1, mailman-3:2.1.29-5.module+el8.1.0+13542+e9b93c88.x86_64::mailman:2.1
Fixes 1 record
Priority LOW 39
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00757 · Published 2021-12-02 · Partial fix · 2.1.38 CWE-352
