------------------------------------------------------------
revno: 1882
fixes bug: https://launchpad.net/bugs/1952384
committer: Mark Sapiro <m...@msapiro.net>
branch nick: 2.1
timestamp: Tue 2021-11-30 09:50:49 -0800
message:
Block CSRF attack against admin or admindb pages.
modified:
Mailman/CSRFcheck.py
Mailman/Cgi/admin.py
Mailman/Cgi/admindb.py
Mailman/Cgi/edithtml.py
NEWS
--
lp:mailman/2.1
https://code.launchpad.net/~mailman-coders/mailman/2.1
Your team Mailman Checkins is subscribed to branch lp:mailman/2.1.
To unsubscribe from this branch go to
https://code.launchpad.net/~mailman-coders/mailman/2.1/+edit-subscription
=== modified file 'Mailman/CSRFcheck.py'
--- Mailman/CSRFcheck.py 2021-11-12 23:23:52 +0000
+++ Mailman/CSRFcheck.py 2021-11-30 17:50:49 +0000
@@ -55,7 +55,7 @@
token = binascii.hexlify(marshal.dumps((issued, keymac)))
return token
-def csrf_check(mlist, token, options_user=None):
+def csrf_check(mlist, token, cgi_user=None):
""" check token by mailman cookie validation algorithm """
try:
issued, keymac = marshal.loads(binascii.unhexlify(token))
@@ -67,12 +67,25 @@
key, user = key.split('+', 1)
else:
user = None
+ # Don't allow unprivileged tokens for admin or admindb.
+ if cgi_user == 'admin':
+ if key not in ('admin', 'site'):
+ syslog('mischief',
+ 'admin form submitted with CSRF token issued for %s.',
+ key + '+' + user if user else key)
+ return False
+ elif cgi_user == 'admindb':
+ if key not in ('moderator', 'admin', 'site'):
+ syslog('mischief',
+ 'admindb form submitted with CSRF token issued for %s.',
+ key + '+' + user if user else key)
+ return False
if user:
# This is for CVE-2021-42097. The token is a user token because
# of the fix for CVE-2021-42096 but it must match the user for
# whom the options page is requested.
raw_user = UnobscureEmail(urllib.unquote(user))
- if options_user and options_user != raw_user:
+ if cgi_user and cgi_user != raw_user:
syslog('mischief',
'Form for user %s submitted with CSRF token '
'issued for %s.',
=== modified file 'Mailman/Cgi/admin.py'
--- Mailman/Cgi/admin.py 2019-10-05 21:32:22 +0000
+++ Mailman/Cgi/admin.py 2021-11-30 17:50:49 +0000
@@ -107,7 +107,8 @@
'legend']
params = cgidata.keys()
if set(params) - set(safe_params):
- csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
+ csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
+ 'admin')
else:
csrf_checked = True
# if password is present, void cookie to force password authentication.
=== modified file 'Mailman/Cgi/admindb.py'
--- Mailman/Cgi/admindb.py 2021-11-12 23:23:52 +0000
+++ Mailman/Cgi/admindb.py 2021-11-30 17:50:49 +0000
@@ -144,7 +144,8 @@
safe_params = ['adminpw', 'admlogin', 'msgid', 'sender', 'details']
params = cgidata.keys()
if set(params) - set(safe_params):
- csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
+ csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
+ 'admindb')
else:
csrf_checked = True
# if password is present, void cookie to force password authentication.
=== modified file 'Mailman/Cgi/edithtml.py'
--- Mailman/Cgi/edithtml.py 2018-07-11 06:52:22 +0000
+++ Mailman/Cgi/edithtml.py 2021-11-30 17:50:49 +0000
@@ -111,7 +111,8 @@
safe_params = ['VARHELP', 'adminpw', 'admlogin']
params = cgidata.keys()
if set(params) - set(safe_params):
- csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
+ csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
+ 'admin')
else:
csrf_checked = True
# if password is present, void cookie to force password authentication.
=== modified file 'NEWS'
--- NEWS 2021-11-22 04:31:11 +0000
+++ NEWS 2021-11-30 17:50:49 +0000
@@ -5,7 +5,12 @@
Here is a history of user visible changes to Mailman.
-2.1.38 (xx-xxx-xxxx)
+2.1.38 (30-Nov-2021)
+
+ Security
+
+ - A potential CSRF attack against a list admin from a list member or
+ moderator has been blocked. CVE-2021-44227 (LP: #1952384)
Bug Fixes and other patches
_______________________________________________
Mailman-checkins mailing list -- mailman-checkins@python.org
To unsubscribe send an email to mailman-checkins-le...@python.org
https://mail.python.org/mailman3/lists/mailman-checkins.python.org/
Member address: arch...@jab.org
