CVE-2021-44227
Fixed in a distro release EPSS <1%
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.
Products: gnu mailman, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | mailman | 2.1.38 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | mailman | 3:2.1.29-12.module_el8.5.0+26+48d4c9ee.2 |
| AlmaLinux 8 | mailman | 3:2.1.29-12.module_el8.5.0+2602+327eb9f3.2 |
| Amazon Linux 2 | mailman | 3:2.1.15-30.amzn2.2 |
| Debian 9 | mailman | 1:2.1.23-1+deb9u8 |
| Red Hat Enterprise Linux 7 | mailman | 3:2.1.15-30.el7_9.2 |
| Red Hat Enterprise Linux 7 | mailman-debuginfo | 3:2.1.15-30.el7_9.2 |
| Red Hat Enterprise Linux 8 | mailman | 3:2.1.29-12.module+el8.5.0+13466+327eb9f3.2 |
| Red Hat Enterprise Linux 8 | mailman-debuginfo | 3:2.1.29-12.module+el8.5.0+13466+327eb9f3.2 |
| Red Hat Enterprise Linux 8 | mailman-debugsource | 3:2.1.29-12.module+el8.5.0+13466+327eb9f3.2 |
| Red Hat rhel e4s 8.1 | mailman | 3:2.1.29-5.module+el8.1.0+13542+e9b93c88 |
| Red Hat rhel e4s 8.1 | mailman-debuginfo | 3:2.1.29-5.module+el8.1.0+13542+e9b93c88 |
| Red Hat rhel e4s 8.1 | mailman-debugsource | 3:2.1.29-5.module+el8.1.0+13542+e9b93c88 |
| Red Hat rhel eus 8.2 | mailman | 3:2.1.29-6.module+el8.2.0+13543+86b2c701 |
| Red Hat rhel eus 8.2 | mailman-debuginfo | 3:2.1.29-6.module+el8.2.0+13543+86b2c701 |
| Red Hat rhel eus 8.2 | mailman-debugsource | 3:2.1.29-6.module+el8.2.0+13543+86b2c701 |
| Red Hat rhel eus 8.4 | mailman | 3:2.1.29-11.module+el8.4.0+13467+746daedf.2 |
| Red Hat rhel eus 8.4 | mailman-debuginfo | 3:2.1.29-11.module+el8.4.0+13467+746daedf.2 |
| Red Hat rhel eus 8.4 | mailman-debugsource | 3:2.1.29-11.module+el8.4.0+13467+746daedf.2 |
| Rocky Linux 8 | mailman | 3:2.1.29-12.module+el8.5.0+717+27fd1ba7.2 |
| Rocky Linux 8 | mailman | 3:2.1.29-12.module+el8.5.0+703+19300c10 |
| SUSE HPE Helion OpenStack 8 | mailman | 2.1.17-3.26.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | mailman | 2.1.17-3.26.1 |
| SUSE Linux Enterprise Server 12 SP3-BCL | mailman | 2.1.17-3.26.1 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | mailman | 2.1.17-3.26.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | mailman | 2.1.17-3.26.1 |
| SUSE Linux Enterprise Server 12 SP5 | mailman | 2.1.17-3.26.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | mailman | 2.1.17-3.26.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | mailman | 2.1.17-3.26.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | mailman | 2.1.17-3.26.1 |
| SUSE OpenStack Cloud 8 | mailman | 2.1.17-3.26.1 |
| SUSE OpenStack Cloud 9 | mailman | 2.1.17-3.26.1 |
| SUSE OpenStack Cloud Crowbar 8 | mailman | 2.1.17-3.26.1 |
| SUSE OpenStack Cloud Crowbar 9 | mailman | 2.1.17-3.26.1 |
| Ubuntu 18.04 LTS | mailman | 1:2.1.26-1ubuntu0.6 |
| Ubuntu Pro 16.04 LTS | mailman | 1:2.1.20-1ubuntu0.6+esm3 |
| Ubuntu Pro 20.04 LTS | mailman | 1:2.1.29-1ubuntu3.1+esm2 |