import mailman-2.1.29-12.module+el8.5.0+13466+327eb9f3.2

SOURCES/mailman-CVE-2021-44227.patch

@@ -0,0 +1,82 @@
+diff --git a/Mailman/CSRFcheck.py b/Mailman/CSRFcheck.py
+index 24e3e11..81998cf 100644
+--- a/Mailman/CSRFcheck.py
++++ b/Mailman/CSRFcheck.py
+@@ -55,7 +55,7 @@ def csrf_token(mlist, contexts, user=None):
+     token = binascii.hexlify(marshal.dumps((issued, keymac)))
+     return token
+ 
+-def csrf_check(mlist, token, options_user=None):
++def csrf_check(mlist, token, cgi_user=None):
+     """ check token by mailman cookie validation algorithm """
+     try:
+         issued, keymac = marshal.loads(binascii.unhexlify(token))
+@@ -67,12 +67,25 @@ def csrf_check(mlist, token, options_user=None):
+             key, user = key.split('+', 1)
+         else:
+             user = None
++        # Don't allow unprivileged tokens for admin or admindb.
++        if cgi_user == 'admin':
++            if key not in ('admin', 'site'):
++                syslog('mischief',
++                       'admin form submitted with CSRF token issued for %s.',
++                       key + '+' + user if user else key)
++                return False
++        elif cgi_user == 'admindb':
++            if key not in ('moderator', 'admin', 'site'):
++                syslog('mischief',
++                       'admindb form submitted with CSRF token issued for %s.',
++                       key + '+' + user if user else key)
++                return False
+         if user:
+             # This is for CVE-2021-42097.  The token is a user token because
+             # of the fix for CVE-2021-42096 but it must match the user for
+             # whom the options page is requested.
+             raw_user = UnobscureEmail(urllib.unquote(user))
+-            if options_user and options_user != raw_user:
++            if cgi_user and cgi_user != raw_user:
+                 syslog('mischief',
+                        'Form for user %s submitted with CSRF token '
+                        'issued for %s.',
+diff --git a/Mailman/Cgi/admin.py b/Mailman/Cgi/admin.py
+index d2577b5..7c600df 100644
+--- a/Mailman/Cgi/admin.py
++++ b/Mailman/Cgi/admin.py
+@@ -107,7 +107,8 @@ def main():
+                    'legend']
+     params = cgidata.keys()
+     if set(params) - set(safe_params):
+-        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
++        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
++                                  'admin')
+     else:
+         csrf_checked = True
+     # if password is present, void cookie to force password authentication.
+diff --git a/Mailman/Cgi/admindb.py b/Mailman/Cgi/admindb.py
+index 58bb357..c152501 100644
+--- a/Mailman/Cgi/admindb.py
++++ b/Mailman/Cgi/admindb.py
+@@ -144,7 +144,8 @@ def main():
+     safe_params = ['adminpw', 'admlogin', 'msgid', 'sender', 'details']
+     params = cgidata.keys()
+     if set(params) - set(safe_params):
+-        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
++        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
++                                  'admindb')
+     else:
+         csrf_checked = True
+     # if password is present, void cookie to force password authentication.
+diff --git a/Mailman/Cgi/edithtml.py b/Mailman/Cgi/edithtml.py
+index 1dd9e87..170e811 100644
+--- a/Mailman/Cgi/edithtml.py
++++ b/Mailman/Cgi/edithtml.py
+@@ -111,7 +111,8 @@ def main():
+     safe_params = ['VARHELP', 'adminpw', 'admlogin']
+     params = cgidata.keys()
+     if set(params) - set(safe_params):
+-        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
++        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
++                                  'admin')
+     else:
+         csrf_checked = True
+     # if password is present, void cookie to force password authentication.

SPECS/mailman.spec

@@ -3,7 +3,7 @@
 Summary: Mailing list manager with built in Web access
 Name: mailman
 Version: 2.1.29
-Release: 12%{?dist}.1
+Release: 12%{?dist}.2
 Epoch: 3
 Group: Applications/Internet
 Source0: ftp://ftp.gnu.org/pub/gnu/mailman/mailman-%{version}.tgz
@@ -34,7 +34,8 @@ Patch26: mailman-bouncer_oom_crash.patch
 Patch27: mailman-2.1.29-login_content_injection.patch
 Patch28: mailman-2.1.29-options_content_njection.patch
 Patch29: mailman-2.1.29-cmd_reply_encoding.patch
-Patch30: mailmain-CVE-2021-42096-2021-42097.patch
+Patch30: mailman-CVE-2021-42096-2021-42097.patch
+Patch31: mailman-CVE-2021-44227.patch
 
 License: GPLv2+
 URL: http://www.list.org/
@@ -129,6 +130,7 @@ additional installation steps, these are described in:
 %patch28 -p0 -b .options_injection
 %patch29 -p0 -b .cmd_reply_encoding
 %patch30 -p1 -b .CVE-2021-42096-2021-42097
+%patch31 -p1 -b .CVE-2021-44227
 
 #cp $RPM_SOURCE_DIR/mailman.INSTALL.REDHAT.in INSTALL.REDHAT.in
 cp %{SOURCE5} INSTALL.REDHAT.in
@@ -582,6 +584,10 @@ exit 0
 %dir %attr(775,root,%{mmgroup}) %{lockdir}
 
 %changelog
+* Sun Nov 28 2021 Martin Osvald <mosvald@redhat.com> - 3:2.1.29-12.2
+- Fix for CVE-2021-44227
+- Resolves: #2026871
+
 * Tue Nov 09 2021 Martin Osvald <mosvald@redhat.com> - 3:2.1.29-12.1
 - Fix for CVE-2021-42096
 - Fix for CVE-2021-42097