Source: mailman Version: 1:2.1.29-1 Severity: grave Tags: security upstream Control: found -1 1:2.1.23-1+deb9u4 Control: found -1 1:2.1.23-1 Control: fixed -1 1:2.1.23-1+deb9u5 Control: fixed -1 1:2.1.29-1+deb10u1
Hi, Note filling this mainly for tracking and for the "regression" from stable. Given that, if no upload happens at point release time it might just prop-up from stable to unstable and so include the fix as well for bullseye. The following vulnerability was published for mailman. CVE-2020-12137[0]: | GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed | application/octet-stream MIME parts. This behavior may contribute to | XSS attacks against list-archive visitors, because an HTTP reply from | an archive web server may lack a MIME type, and a web browser may | perform MIME sniffing, conclude that the MIME type should have been | text/html, and execute JavaScript code. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2020-12137 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12137 Regards, Salvatore
