Your message dated Fri, 14 Jan 2005 04:47:08 -0500
with message-id <[EMAIL PROTECTED]>
and subject line Bug#286796: fixed in mailman 2.1.5-5
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 22 Dec 2004 09:53:03 +0000
>From [EMAIL PROTECTED] Wed Dec 22 01:53:03 2004
Return-path: <[EMAIL PROTECTED]>
Received: from albireo.enyo.de [212.9.189.169]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1Ch3B1-0004wi-00; Wed, 22 Dec 2004 01:53:03 -0800
Received: from deneb.enyo.de ([212.9.189.171])
by albireo.enyo.de with esmtp id 1Ch3Az-0003hP-OU
for [EMAIL PROTECTED]; Wed, 22 Dec 2004 10:53:01 +0100
Received: from fw by deneb.enyo.de with local (Exim 4.43)
id 1Ch3Az-0001MJ-H4; Wed, 22 Dec 2004 10:53:01 +0100
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Florian Weimer <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: [CAN-2004-1143] mailman: weak auto-generated passwords
X-Mailer: reportbug 3.4
Date: Wed, 22 Dec 2004 10:53:01 +0100
Message-Id: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2004_03_25
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2004_03_25
X-Spam-Level:
Package: mailman
Severity: grave
Tags: security
Justification: user security hole
Red Had has posted a private vendor-sec posting to a public mailing
list:
<http://mail.python.org/pipermail/mailman-developers/2004-December/017561.html>
Short summary: Mailman only generates about 5 million different
passwords. This means that brute force attacks are possible.
The CVE Project assigned CAN-2004-1143 to this vulnerability.
-- System Information:
Debian Release: 3.1
APT prefers unstable
APT policy: (800, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.10-rc3fw
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
---------------------------------------
Received: (at 286796-close) by bugs.debian.org; 14 Jan 2005 09:53:02 +0000
>From [EMAIL PROTECTED] Fri Jan 14 01:53:02 2005
Return-path: <[EMAIL PROTECTED]>
Received: from newraff.debian.org [208.185.25.31] (mail)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1CpO8c-0004Kc-00; Fri, 14 Jan 2005 01:53:02 -0800
Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian))
id 1CpO2u-0003P1-00; Fri, 14 Jan 2005 04:47:08 -0500
From: Tollef Fog Heen <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.54 $
Subject: Bug#286796: fixed in mailman 2.1.5-5
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Fri, 14 Jan 2005 04:47:08 -0500
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-5.0 required=4.0 tests=BAYES_00,DATING,
HAS_BUG_NUMBER autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
X-CrossAssassin-Score: 4
Source: mailman
Source-Version: 2.1.5-5
We believe that the bug you reported is fixed in the latest version of
mailman, which is due to be installed in the Debian FTP archive:
mailman_2.1.5-5.diff.gz
to pool/main/m/mailman/mailman_2.1.5-5.diff.gz
mailman_2.1.5-5.dsc
to pool/main/m/mailman/mailman_2.1.5-5.dsc
mailman_2.1.5-5_i386.deb
to pool/main/m/mailman/mailman_2.1.5-5_i386.deb
mailman_2.1.5.orig.tar.gz
to pool/main/m/mailman/mailman_2.1.5.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Tollef Fog Heen <[EMAIL PROTECTED]> (supplier of updated mailman package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Mon, 10 Jan 2005 17:12:58 +0100
Source: mailman
Binary: mailman
Architecture: source i386
Version: 2.1.5-5
Distribution: unstable
Urgency: high
Maintainer: Tollef Fog Heen <[EMAIL PROTECTED]>
Changed-By: Tollef Fog Heen <[EMAIL PROTECTED]>
Description:
mailman - Powerful, web-based mailing list manager
Closes: 280529 284771 285839 286796 287555
Changes:
mailman (2.1.5-5) unstable; urgency=high
.
* Fix CAN-2004-1143 (weak auto-generated passwords) by pulling the
appropriate CVS change from upstream. Thanks to Florian Weimer for
finding and producing a patch for this bug. (closes: #286796)
* Fix CAN-2004-1177 (CSS problem in scripts/driver) by pulling the
appropriate patch from upstream CVS. Thanks to Florian Weimer for
discovering and producing a patch for this bug. (closes: #287555)
* Handle the case of upgrading from Mailman 2.0 where we have
pending subscriptions. This should hopefully fix #280529. Thanks to
Bastian Kleinedam for the patch. (closes: #280529)
* Skip directories when updating templates, to make the life easier for
people who have their configuration in Subversion or Arch.
(closes: #284771)
* Remove 55_options_traceback.dpatch as this problem seems to have been
fixed upstream and it causes other problems. (closes: #285839)
Files:
211e90f80573d909d805e2b9d40dd21e 640 mail optional mailman_2.1.5-5.dsc
f5f56f04747cd4aff67427e7a45631af 5745912 mail optional
mailman_2.1.5.orig.tar.gz
7c0131c39ae93621120673b94cde9be7 174358 mail optional mailman_2.1.5-5.diff.gz
997fd482d1a92d751c132a449d150fc9 6607802 mail optional mailman_2.1.5-5_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
iD8DBQFB55BlQSseMYF6mWoRAkzVAKDa2oVG7RsLLZ/P2rUFQj2pkporAwCaA+t/
6oqxdXJcck5pDz8V85oMpPw=
=af3J
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
