diff options
| author | Matthias Andree <mandree@FreeBSD.org> | 2021-11-13 10:27:55 +0000 |
|---|---|---|
| committer | Matthias Andree <mandree@FreeBSD.org> | 2021-11-13 10:37:57 +0000 |
| commit | 835b5e71120b126c4cddd012f972661330810d32 (patch) | |
| tree | fe040744b85670e6d7602c7ae88348efe86c7ea7 | |
| parent | b19956a706443169d64e9a0bca00a651e605c608 (diff) | |
mail/mailman: security update to 2.1.37
- A potential XSS attack via the user options page has been reported by
Harsh Jaiswal. This is fixed. CVE-2021-43331 (LP: #1949401)
LP: A crafted URL to the user options page can execute arbitrary
javascript.
- A potential for for a list moderator to carry out an off-line brute force
attack to obtain the list admin password has been reported by Andre
Protas, Richard Cloke and Andy Nuttall of Apple. This is fixed.
CVE-2021-43332 (LP: #1949403)
LP: The CSRF token for the admindb page contains an encrypted version of
the list admin password which could potentially be cracked by a
moderator via an off-line brute force attack.
ChangeLog:
https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/1879/NEWS#L2
MFH: 2021Q4
Security: 9d7a2b54-4468-11ec-8532-0d24c37c72c8
Security: CVE-2021-43331
Security: CVE-2021-43332
(cherry picked from commit f05ee16987d1bf5d7002e939614f853d99286fe7)
| -rw-r--r-- | mail/mailman/Makefile | 2 | ||||
| -rw-r--r-- | mail/mailman/distinfo | 6 |
2 files changed, 4 insertions, 4 deletions
diff --git a/mail/mailman/Makefile b/mail/mailman/Makefile index a5a447104393..8250bc733ec6 100644 --- a/mail/mailman/Makefile +++ b/mail/mailman/Makefile @@ -1,7 +1,7 @@ # Created by: n_hibma@qubesoft.com PORTNAME= mailman -DISTVERSION= 2.1.35 +DISTVERSION= 2.1.37 CATEGORIES= mail MASTER_SITES= GNU \ SF/${PORTNAME}/Mailman%202.1%20%28stable%29/${PORTVERSION} \ diff --git a/mail/mailman/distinfo b/mail/mailman/distinfo index 1972fab47297..b7eb6f32f810 100644 --- a/mail/mailman/distinfo +++ b/mail/mailman/distinfo @@ -1,5 +1,5 @@ -TIMESTAMP = 1634751988 -SHA256 (mailman/mailman-2.1.35.tgz) = 4ac4d29648144049ef9fa5b1ecd5441b5bd5373111f200c933ebe5c589ba46bf -SIZE (mailman/mailman-2.1.35.tgz) = 9508348 +TIMESTAMP = 1636797368 +SHA256 (mailman/mailman-2.1.37.tgz) = 689ff350857728ccc4ed379ceef54b93f710af8740cabc3bfe0348173b6b3f4f +SIZE (mailman/mailman-2.1.37.tgz) = 9508379 SHA256 (mailman/msapiro-htdig-1822.patch.xz) = fa1da6fb7c0946a6723bc2766501c222fa73c8d794566a3b6e5718a7d1840265 SIZE (mailman/msapiro-htdig-1822.patch.xz) = 50700 |