headers
Barry A. Warsaw | 9 Nov 2001 23:41

RELEASE Mailman 2.0.7

Hi all,

I'm releasing Mailman 2.0.7 which fixes two potential, though obscure
security or denial-of-service attacks, along with a few other minor
bug fixes.  Details:

- If you are running Python 1.5.2, it is possible for someone to
  carefully craft some cookie data, and then trick Mailman into
  accepting that data, that will crash your Python interpreter.

  If you are not running Python 1.5.2, you should be invulnerable to
  the crash, however it is still possible for someone to even more
  carefully craft some cookie data that could cause arbitrary class
  constructors to be executed on the server.

  While I believe it is difficult to exploit this, Mailman 2.0.7
  closes this hole completely, by disabling the Cookie.py module's
  default unpickling of cookie data.

- It is possible that Mailman's bounce handler could receive a bounce
  message that looked like a DSN report, but was incorrectly
  formatted.  Under Mailman 2.0.6's bounce detector, you would get a
  traceback for a message that would never be removed from the queue,
  thus potentially wedging your qrunner until the offending message
  was manually deleted.

  Mailman 2.0.7 fixes the DSN.py bounce detector.

There are a few other useful bug fixes in this release, described in
the NEWS excerpt below.  I recommend anybody running a version of
(Continue reading)

Permalink | Reply | 0 comments |
headers
Barry A. Warsaw | 28 Nov 2001 05:31

RELEASE Mailman 2.0.8

Hot on the heels of Mailman 2.0.7, I'm now releasing 2.0.8 which fixes
several cross-site scripting security holes, and a few other minor bug
fixes.  More information on cross-site scripting exploits in general
can be found at

    http://www.cert.org/advisories/CA-2000-02.html

I recommend anybody running a version of Mailman up to, and including
2.0.7 to upgrade to version 2.0.8.

I've made both full source tarballs and patches available.  Actually,
patches going all the way back to 2.0 are now available on
SourceForge.  See

    http://sourceforge.net/project/showfiles.php?group_id=103

for links to download all the patches and the source tarball.  If you
decide to install the patches, please do read the release notes first:

    http://sourceforge.net/project/shownotes.php?release_id=63042

Currently the SourceForge and www.list.org sites are up-to-date, and I
expect the gnu.org site to be updated soon.

See also:

    http://www.gnu.org/software/mailman
    http://www.list.org
    http://mailman.sf.net
(Continue reading)

Permalink | Reply | 0 comments |

Gmane