import mailman-2.1.29-12.module+el8.5.0+13466+327eb9f3.2
This commit is contained in:
CentOS Sources
Stepan Oksanichenko
parent
e666bb0369
commit
bbfa00699e
82
SOURCES/mailman-CVE-2021-44227.patch
Normal file
82
SOURCES/mailman-CVE-2021-44227.patch
Normal file
@ -0,0 +1,82 @@
|
||||
diff --git a/Mailman/CSRFcheck.py b/Mailman/CSRFcheck.py
|
||||
index 24e3e11..81998cf 100644
|
||||
--- a/Mailman/CSRFcheck.py
|
||||
+++ b/Mailman/CSRFcheck.py
|
||||
@@ -55,7 +55,7 @@ def csrf_token(mlist, contexts, user=None):
|
||||
token = binascii.hexlify(marshal.dumps((issued, keymac)))
|
||||
return token
|
||||
|
||||
-def csrf_check(mlist, token, options_user=None):
|
||||
+def csrf_check(mlist, token, cgi_user=None):
|
||||
""" check token by mailman cookie validation algorithm """
|
||||
try:
|
||||
issued, keymac = marshal.loads(binascii.unhexlify(token))
|
||||
@@ -67,12 +67,25 @@ def csrf_check(mlist, token, options_user=None):
|
||||
key, user = key.split('+', 1)
|
||||
else:
|
||||
user = None
|
||||
+ # Don't allow unprivileged tokens for admin or admindb.
|
||||
+ if cgi_user == 'admin':
|
||||
+ if key not in ('admin', 'site'):
|
||||
+ syslog('mischief',
|
||||
+ 'admin form submitted with CSRF token issued for %s.',
|
||||
+ key + '+' + user if user else key)
|
||||
+ return False
|
||||
+ elif cgi_user == 'admindb':
|
||||
+ if key not in ('moderator', 'admin', 'site'):
|
||||
+ syslog('mischief',
|
||||
+ 'admindb form submitted with CSRF token issued for %s.',
|
||||
+ key + '+' + user if user else key)
|
||||
+ return False
|
||||
if user:
|
||||
# This is for CVE-2021-42097. The token is a user token because
|
||||
# of the fix for CVE-2021-42096 but it must match the user for
|
||||
# whom the options page is requested.
|
||||
raw_user = UnobscureEmail(urllib.unquote(user))
|
||||
- if options_user and options_user != raw_user:
|
||||
+ if cgi_user and cgi_user != raw_user:
|
||||
syslog('mischief',
|
||||
'Form for user %s submitted with CSRF token '
|
||||
'issued for %s.',
|
||||
diff --git a/Mailman/Cgi/admin.py b/Mailman/Cgi/admin.py
|
||||
index d2577b5..7c600df 100644
|
||||
--- a/Mailman/Cgi/admin.py
|
||||
+++ b/Mailman/Cgi/admin.py
|
||||
@@ -107,7 +107,8 @@ def main():
|
||||
'legend']
|
||||
params = cgidata.keys()
|
||||
if set(params) - set(safe_params):
|
||||
- csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
|
||||
+ csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
|
||||
+ 'admin')
|
||||
else:
|
||||
csrf_checked = True
|
||||
# if password is present, void cookie to force password authentication.
|
||||
diff --git a/Mailman/Cgi/admindb.py b/Mailman/Cgi/admindb.py
|
||||
index 58bb357..c152501 100644
|
||||
--- a/Mailman/Cgi/admindb.py
|
||||
+++ b/Mailman/Cgi/admindb.py
|
||||
@@ -144,7 +144,8 @@ def main():
|
||||
safe_params = ['adminpw', 'admlogin', 'msgid', 'sender', 'details']
|
||||
params = cgidata.keys()
|
||||
if set(params) - set(safe_params):
|
||||
- csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
|
||||
+ csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
|
||||
+ 'admindb')
|
||||
else:
|
||||
csrf_checked = True
|
||||
# if password is present, void cookie to force password authentication.
|
||||
diff --git a/Mailman/Cgi/edithtml.py b/Mailman/Cgi/edithtml.py
|
||||
index 1dd9e87..170e811 100644
|
||||
--- a/Mailman/Cgi/edithtml.py
|
||||
+++ b/Mailman/Cgi/edithtml.py
|
||||
@@ -111,7 +111,8 @@ def main():
|
||||
safe_params = ['VARHELP', 'adminpw', 'admlogin']
|
||||
params = cgidata.keys()
|
||||
if set(params) - set(safe_params):
|
||||
- csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
|
||||
+ csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
|
||||
+ 'admin')
|
||||
else:
|
||||
csrf_checked = True
|
||||
# if password is present, void cookie to force password authentication.
|
||||
@ -3,7 +3,7 @@
|
||||
Summary: Mailing list manager with built in Web access
|
||||
Name: mailman
|
||||
Version: 2.1.29
|
||||
Release: 12%{?dist}.1
|
||||
Release: 12%{?dist}.2
|
||||
Epoch: 3
|
||||
Group: Applications/Internet
|
||||
Source0: ftp://ftp.gnu.org/pub/gnu/mailman/mailman-%{version}.tgz
|
||||
@ -34,7 +34,8 @@ Patch26: mailman-bouncer_oom_crash.patch
|
||||
Patch27: mailman-2.1.29-login_content_injection.patch
|
||||
Patch28: mailman-2.1.29-options_content_njection.patch
|
||||
Patch29: mailman-2.1.29-cmd_reply_encoding.patch
|
||||
Patch30: mailmain-CVE-2021-42096-2021-42097.patch
|
||||
Patch30: mailman-CVE-2021-42096-2021-42097.patch
|
||||
Patch31: mailman-CVE-2021-44227.patch
|
||||
|
||||
License: GPLv2+
|
||||
URL: http://www.list.org/
|
||||
@ -129,6 +130,7 @@ additional installation steps, these are described in:
|
||||
%patch28 -p0 -b .options_injection
|
||||
%patch29 -p0 -b .cmd_reply_encoding
|
||||
%patch30 -p1 -b .CVE-2021-42096-2021-42097
|
||||
%patch31 -p1 -b .CVE-2021-44227
|
||||
|
||||
#cp $RPM_SOURCE_DIR/mailman.INSTALL.REDHAT.in INSTALL.REDHAT.in
|
||||
cp %{SOURCE5} INSTALL.REDHAT.in
|
||||
@ -582,6 +584,10 @@ exit 0
|
||||
%dir %attr(775,root,%{mmgroup}) %{lockdir}
|
||||
|
||||
%changelog
|
||||
* Sun Nov 28 2021 Martin Osvald <mosvald@redhat.com> - 3:2.1.29-12.2
|
||||
- Fix for CVE-2021-44227
|
||||
- Resolves: #2026871
|
||||
|
||||
* Tue Nov 09 2021 Martin Osvald <mosvald@redhat.com> - 3:2.1.29-12.1
|
||||
- Fix for CVE-2021-42096
|
||||
- Fix for CVE-2021-42097
|
||||
|
||||
Loading…
Reference in New Issue
Block a user