Security update for mailman SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:1452-1 Final 1 1 2021-11-05T15:06:22Z current 2021-11-05T15:06:22Z 2021-11-05T15:06:22Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for mailman This update for mailman fixes the following issues: Update to 2.1.35 to fix 2 security issues: - A potential for for a list member to carry out an off-line brute force attack to obtain the list admin password has been reported by Andre Protas, Richard Cloke and Andy Nuttall of Apple. This is fixed. CVE-2021-42096 (boo#1191959, LP:#1947639) - A CSRF attack via the user options page could allow takeover of a users account. This is fixed. CVE-2021-42097 (boo#1191960, LP:#1947640) - make package build reproducible (boo#1047218) This update was imported from the openSUSE:Leap:15.2:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2021-1452 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FJE7PQHJDJVNG4MP75G5GY65ABFE2RAP/ E-Mail link for openSUSE-SU-2021:1452-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1047218 SUSE Bug 1047218 https://bugzilla.suse.com/1191959 SUSE Bug 1191959 https://bugzilla.suse.com/1191960 SUSE Bug 1191960 https://www.suse.com/security/cve/CVE-2021-42096/ SUSE CVE CVE-2021-42096 page https://www.suse.com/security/cve/CVE-2021-42097/ SUSE CVE CVE-2021-42097 page SUSE Package Hub 15 SP2 mailman-2.1.35-bp152.7.6.1 mailman-2.1.35-bp152.7.6.1 as a component of SUSE Package Hub 15 SP2 GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password. CVE-2021-42096 SUSE Package Hub 15 SP2:mailman-2.1.35-bp152.7.6.1 moderate 4 AV:N/AC:L/Au:S/C:P/I:N/A:N 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FJE7PQHJDJVNG4MP75G5GY65ABFE2RAP/ https://www.suse.com/security/cve/CVE-2021-42096.html CVE-2021-42096 https://bugzilla.suse.com/1191959 SUSE Bug 1191959 GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover). CVE-2021-42097 SUSE Package Hub 15 SP2:mailman-2.1.35-bp152.7.6.1 moderate 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FJE7PQHJDJVNG4MP75G5GY65ABFE2RAP/ https://www.suse.com/security/cve/CVE-2021-42097.html CVE-2021-42097 https://bugzilla.suse.com/1191960 SUSE Bug 1191960