Описание
Security update for mailman
This update for mailman fixes the following issues:
- CVE-2021-44227: Preventing list moderator or list member accessing the admin UI (bsc#1193316).
- CVE-2021-43332: Preventing list moderator from cracking the list admin password encrypted in a CSRF token (bsc#1192741).
- CVE-2021-43331: Fixed XSS in Cgi/options.py (bsc#1192735).
- CVE-2021-42096: Add protection against remote privilege escalation via csrf_token derived from admin password (bsc#1191959).
Список пакетов
HPE Helion OpenStack 8
SUSE Linux Enterprise Server 12 SP2-BCL
SUSE Linux Enterprise Server 12 SP3-BCL
SUSE Linux Enterprise Server 12 SP3-LTSS
SUSE Linux Enterprise Server 12 SP4-LTSS
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server for SAP Applications 12 SP3
SUSE Linux Enterprise Server for SAP Applications 12 SP4
SUSE Linux Enterprise Server for SAP Applications 12 SP5
SUSE OpenStack Cloud 8
SUSE OpenStack Cloud 9
SUSE OpenStack Cloud Crowbar 8
SUSE OpenStack Cloud Crowbar 9
Ссылки
- Link for SUSE-SU-2022:1886-1
- E-Mail link for SUSE-SU-2022:1886-1
- SUSE Security Ratings
- SUSE Bug 1191959
- SUSE Bug 1192735
- SUSE Bug 1192741
- SUSE Bug 1193316
- SUSE CVE CVE-2021-42096 page
- SUSE CVE CVE-2021-43331 page
- SUSE CVE CVE-2021-43332 page
- SUSE CVE CVE-2021-44227 page
Описание
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password.
Затронутые продукты
Ссылки
- CVE-2021-42096
- SUSE Bug 1191959
Описание
In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.
Затронутые продукты
Ссылки
- CVE-2021-43331
- SUSE Bug 1192735
Описание
In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.
Затронутые продукты
Ссылки
- CVE-2021-43332
- SUSE Bug 1192741
Описание
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.
Затронутые продукты
Ссылки
- CVE-2021-44227
- SUSE Bug 1193316