.gitignore

@@ -1 +1 @@
-SOURCES/mailman-2.1.29.tgz
+SOURCES/mailman-2.1.30.tgz

.mailman.metadata

@@ -1 +1 @@
-40fe97974a6f0805a01d55c6944565f238778238 SOURCES/mailman-2.1.29.tgz
+01f3c33d057b771fd9bac3684f2f9be1d1000254 SOURCES/mailman-2.1.30.tgz

SOURCES/mailman-2.1.29-cmd_reply_encoding.patch

@@ -0,0 +1,16 @@
+=== modified file 'Mailman/Queue/CommandRunner.py'
+--- Mailman/Queue/CommandRunner.py	2018-06-17 23:47:34 +0000
++++ Mailman/Queue/CommandRunner.py	2021-03-31 21:53:20 +0000
+@@ -100,6 +100,11 @@
+             # E.g the outer Content-Type: was text/html
+             return
+         body = part.get_payload(decode=True)
++        if (part.get_content_charset(None)):
++            body = unicode(body, part.get_content_charset(),
++                           errors='replace').encode(
++                           Utils.GetCharSet(self.msgdata['lang']),
++                           errors='replace')
+         # text/plain parts better have string payloads
+         assert isinstance(body, StringType) or isinstance(body, UnicodeType)
+         lines = body.splitlines()
+

SOURCES/mailman-CVE-2020-12137.patch

@@ -1,14 +0,0 @@
-=== modified file 'Mailman/Handlers/Scrubber.py'
---- Mailman/Handlers/Scrubber.py	2018-06-17 23:47:34 +0000
-+++ Mailman/Handlers/Scrubber.py	2018-11-10 18:57:54 +0000
-@@ -87,6 +87,9 @@
-     all = guess_all_extensions(ctype, strict=False)
-     if ext in all:
-         return ext
-+    if ctype.lower == 'application/octet-stream':
-+        # For this type, all[0] is '.obj'. '.bin' is better.
-+        return '.bin'
-     return all and all[0]
- 
- 
-

SOURCES/mailman-CVE-2021-42096-2021-42097.patch

@@ -0,0 +1,129 @@
+diff --git a/Mailman/CSRFcheck.py b/Mailman/CSRFcheck.py
+index a1e78d9..0940b7e 100644
+--- a/Mailman/CSRFcheck.py
++++ b/Mailman/CSRFcheck.py
+@@ -18,11 +18,13 @@
+ """ Cross-Site Request Forgery checker """
+ 
+ import time
++import urllib
+ import marshal
+ import binascii
+ 
+ from Mailman import mm_cfg
+-from Mailman.Utils import sha_new
++from Mailman.Logging.Syslog import syslog
++from Mailman.Utils import UnobscureEmail, sha_new
+ 
+ keydict = {
+     'user':      mm_cfg.AuthUser,
+@@ -37,6 +39,10 @@ keydict = {
+ def csrf_token(mlist, contexts, user=None):
+     """ create token by mailman cookie generation algorithm """
+ 
++    if user:
++        # Unmunge a munged email address.
++        user = UnobscureEmail(urllib.unquote(user))
++
+     for context in contexts:
+         key, secret = mlist.AuthContextInfo(context, user)
+         if key:
+@@ -49,9 +55,8 @@ def csrf_token(mlist, contexts, user=None):
+     token = binascii.hexlify(marshal.dumps((issued, keymac)))
+     return token
+ 
+-def csrf_check(mlist, token):
++def csrf_check(mlist, token, options_user=None):
+     """ check token by mailman cookie validation algorithm """
+-
+     try:
+         issued, keymac = marshal.loads(binascii.unhexlify(token))
+         key, received_mac = keymac.split(':', 1)
+@@ -62,6 +67,17 @@ def csrf_check(mlist, token):
+             key, user = key.split('+', 1)
+         else:
+             user = None
++        if user:
++            # This is for CVE-2021-42097.  The token is a user token because
++            # of the fix for CVE-2021-42096 but it must match the user for
++            # whom the options page is requested.
++            raw_user = UnobscureEmail(urllib.unquote(user))
++            if options_user and options_user != raw_user:
++                syslog('mischief',
++                       'Form for user %s submitted with CSRF token '
++                       'issued for %s.',
++                       options_user, raw_user)
++                return False
+         context = keydict.get(key)
+         key, secret = mlist.AuthContextInfo(context, user)
+         assert key
+diff --git a/Mailman/Cgi/options.py b/Mailman/Cgi/options.py
+index ee2293e..472a02b 100644
+--- a/Mailman/Cgi/options.py
++++ b/Mailman/Cgi/options.py
+@@ -54,9 +54,6 @@ except NameError:
+     True = 1
+     False = 0
+ 
+-AUTH_CONTEXTS = (mm_cfg.AuthListAdmin, mm_cfg.AuthSiteAdmin,
+-                 mm_cfg.AuthListModerator, mm_cfg.AuthUser)
+-
+ 
+ def main():
+     global _
+@@ -124,15 +121,6 @@ def main():
+         print doc.Format()
+         return
+ 
+-    if set(params) - set(safe_params):
+-        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
+-    else:
+-        csrf_checked = True
+-    # if password is present, void cookie to force password authentication.
+-    if cgidata.getfirst('password'):
+-        os.environ['HTTP_COOKIE'] = ''
+-        csrf_checked = True
+-
+     # Set the language for the page.  If we're coming from the listinfo cgi,
+     # we might have a 'language' key in the cgi data.  That was an explicit
+     # preference to view the page in, so we should honor that here.  If that's
+@@ -169,6 +157,16 @@ def main():
+             user = user[-1].strip()
+ 
+     # Avoid cross-site scripting attacks
++    if set(params) - set(safe_params):
++        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
++                                  Utils.UnobscureEmail(urllib.unquote(user)))
++    else:
++        csrf_checked = True
++    # if password is present, void cookie to force password authentication.
++    if cgidata.getfirst('password'):
++        os.environ['HTTP_COOKIE'] = ''
++        csrf_checked = True
++
+     safeuser = Utils.websafe(user)
+     try:
+         Utils.ValidateEmail(user)
+@@ -868,8 +866,9 @@ def options_page(mlist, doc, user, cpuser, userlang, message=''):
+         mlist.FormatButton('othersubs',
+                            _('List my other subscriptions')))
+     replacements['<mm-form-start>'] = (
++        # Always make the CSRF token for the user. CVE-2021-42096
+         mlist.FormatFormStart('options', user, mlist=mlist, 
+-            contexts=AUTH_CONTEXTS, user=user))
++            contexts=[mm_cfg.AuthUser], user=user))
+     replacements['<mm-user>'] = user
+     replacements['<mm-presentable-user>'] = presentable_user
+     replacements['<mm-email-my-pw>'] = mlist.FormatButton(
+diff --git a/Mailman/SecurityManager.py b/Mailman/SecurityManager.py
+index 9b7f03f..e9e5ce5 100644
+--- a/Mailman/SecurityManager.py
++++ b/Mailman/SecurityManager.py
+@@ -104,6 +104,7 @@ class SecurityManager:
+             if user is None:
+                 # A bad system error
+                 raise TypeError, 'No user supplied for AuthUser context'
++            user = Utils.UnobscureEmail(urllib.unquote(user))
+             secret = self.getMemberPassword(user)
+             userdata = urllib.quote(Utils.ObscureEmail(user), safe='')
+             key += 'user+%s' % userdata

SOURCES/mailman-CVE-2021-44227.patch

@@ -0,0 +1,82 @@
+diff --git a/Mailman/CSRFcheck.py b/Mailman/CSRFcheck.py
+index 24e3e11..81998cf 100644
+--- a/Mailman/CSRFcheck.py
++++ b/Mailman/CSRFcheck.py
+@@ -55,7 +55,7 @@ def csrf_token(mlist, contexts, user=None):
+     token = binascii.hexlify(marshal.dumps((issued, keymac)))
+     return token
+ 
+-def csrf_check(mlist, token, options_user=None):
++def csrf_check(mlist, token, cgi_user=None):
+     """ check token by mailman cookie validation algorithm """
+     try:
+         issued, keymac = marshal.loads(binascii.unhexlify(token))
+@@ -67,12 +67,25 @@ def csrf_check(mlist, token, options_user=None):
+             key, user = key.split('+', 1)
+         else:
+             user = None
++        # Don't allow unprivileged tokens for admin or admindb.
++        if cgi_user == 'admin':
++            if key not in ('admin', 'site'):
++                syslog('mischief',
++                       'admin form submitted with CSRF token issued for %s.',
++                       key + '+' + user if user else key)
++                return False
++        elif cgi_user == 'admindb':
++            if key not in ('moderator', 'admin', 'site'):
++                syslog('mischief',
++                       'admindb form submitted with CSRF token issued for %s.',
++                       key + '+' + user if user else key)
++                return False
+         if user:
+             # This is for CVE-2021-42097.  The token is a user token because
+             # of the fix for CVE-2021-42096 but it must match the user for
+             # whom the options page is requested.
+             raw_user = UnobscureEmail(urllib.unquote(user))
+-            if options_user and options_user != raw_user:
++            if cgi_user and cgi_user != raw_user:
+                 syslog('mischief',
+                        'Form for user %s submitted with CSRF token '
+                        'issued for %s.',
+diff --git a/Mailman/Cgi/admin.py b/Mailman/Cgi/admin.py
+index d2577b5..7c600df 100644
+--- a/Mailman/Cgi/admin.py
++++ b/Mailman/Cgi/admin.py
+@@ -107,7 +107,8 @@ def main():
+                    'legend']
+     params = cgidata.keys()
+     if set(params) - set(safe_params):
+-        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
++        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
++                                  'admin')
+     else:
+         csrf_checked = True
+     # if password is present, void cookie to force password authentication.
+diff --git a/Mailman/Cgi/admindb.py b/Mailman/Cgi/admindb.py
+index 58bb357..c152501 100644
+--- a/Mailman/Cgi/admindb.py
++++ b/Mailman/Cgi/admindb.py
+@@ -144,7 +144,8 @@ def main():
+     safe_params = ['adminpw', 'admlogin', 'msgid', 'sender', 'details']
+     params = cgidata.keys()
+     if set(params) - set(safe_params):
+-        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
++        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
++                                  'admindb')
+     else:
+         csrf_checked = True
+     # if password is present, void cookie to force password authentication.
+diff --git a/Mailman/Cgi/edithtml.py b/Mailman/Cgi/edithtml.py
+index 1dd9e87..170e811 100644
+--- a/Mailman/Cgi/edithtml.py
++++ b/Mailman/Cgi/edithtml.py
+@@ -111,7 +111,8 @@ def main():
+     safe_params = ['VARHELP', 'adminpw', 'admlogin']
+     params = cgidata.keys()
+     if set(params) - set(safe_params):
+-        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
++        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
++                                  'admin')
+     else:
+         csrf_checked = True
+     # if password is present, void cookie to force password authentication.

SOURCES/mailman-bouncer_oom_crash.patch

@@ -1,78 +0,0 @@
---- Mailman/Bouncers/SimpleMatch.py	2018-06-17 23:47:34 +0000
-+++ Mailman/Bouncers/SimpleMatch.py	2020-01-17 00:03:34 +0000
-@@ -25,6 +25,9 @@
- def _c(pattern):
-     return re.compile(pattern, re.IGNORECASE)
- 
-+# Pattern to match any valid email address and not much more.
-+VALID = _c(r'[\x21-\x3d\x3f\x41-\x7e]+@[a-z0-9._]+')
-+
- # This is a list of tuples of the form
- #
- #     (start cre, end cre, address cre)
-@@ -227,4 +230,4 @@
-                     break
-         if addrs:
-             break
--    return addrs.keys()
-+    return [x for x in addrs.keys() if VALID.match(x)]
-
-=== modified file 'Mailman/Bouncers/SimpleWarning.py'
---- Mailman/Bouncers/SimpleWarning.py	2018-06-17 23:47:34 +0000
-+++ Mailman/Bouncers/SimpleWarning.py	2020-01-17 00:03:34 +0000
-@@ -17,9 +17,10 @@
- 
- """Recognizes simple heuristically delimited warnings."""
- 
-+import email
-+
- from Mailman.Bouncers.BouncerAPI import Stop
- from Mailman.Bouncers.SimpleMatch import _c
--from Mailman.Bouncers.SimpleMatch import process as _process
- 
- 
- 
-@@ -67,8 +68,25 @@
- 
- 
- def process(msg):
--    if _process(msg, patterns):
--        # It's a recognized warning so stop now
--        return Stop
--    else:
--        return []
-+    # We used to just import process from SimpleMatch, but with the change in
-+    # SimpleMatch to return only vaild addresses, that doesn't work any more.
-+    # So, we copy most of the process from SimpleMatch here.
-+    addrs = {}
-+    for scre, ecre, acre in patterns:
-+        state = 0
-+        for line in email.Iterators.body_line_iterator(msg, decode=True):
-+            if state == 0:
-+                if scre.search(line):
-+                    state = 1
-+            if state == 1:
-+                mo = acre.search(line)
-+                if mo:
-+                    addr = mo.group('addr')
-+                    if addr:
-+                        addrs[addr.strip('<>')] = 1
-+                elif ecre.search(line):
-+                    break
-+        if addrs:
-+            # It's a recognized warning so stop now
-+            return Stop
-+    return []
-
---- Mailman/Bouncers/SimpleMatch.py	2020-01-17 00:03:34 +0000
-+++ Mailman/Bouncers/SimpleMatch.py	2020-01-17 03:25:09 +0000
-@@ -26,7 +26,7 @@
-     return re.compile(pattern, re.IGNORECASE)
- 
- # Pattern to match any valid email address and not much more.
--VALID = _c(r'[\x21-\x3d\x3f\x41-\x7e]+@[a-z0-9._]+')
-+VALID = _c(r'^[\x21-\x3d\x3f\x41-\x7e]+@[a-z0-9._]+$')
- 
- # This is a list of tuples of the form
- #
-

SPECS/mailman.spec

@@ -2,12 +2,12 @@
 %global __os_install_post %(echo '%{__os_install_post}' | sed -e 's!/usr/lib[^[:space:]]*/brp-python-bytecompile[[:space:]].*$!!g')
 Summary: Mailing list manager with built in Web access
 Name: mailman
-Version: 2.1.29
-Release: 11%{?dist}
+Version: 2.1.30
+Release: 1%{?dist}
 Epoch: 3
 Group: Applications/Internet
 Source0: ftp://ftp.gnu.org/pub/gnu/mailman/mailman-%{version}.tgz
-#Source0: http://prdownloads.sourceforge.net/mailman/mailman-%{version}.tgz
+#Source0: http://prdownloads.sourceforge.net/mailman/mailman-%%{version}.tgz
 Source1: mm_cfg.py
 Source3: httpd-mailman.conf
 Source4: mailman.logrotate
@@ -29,10 +29,11 @@ Patch13: mailman-2.1.9-unicode.patch
 Patch21: mailman-2.1.13-env-python.patch
 Patch22: mailman-2.1.15-check_perms.patch
 Patch24: mailman-specify_python_version.patch
-Patch25: mailman-CVE-2020-12137.patch
-Patch26: mailman-bouncer_oom_crash.patch
 Patch27: mailman-2.1.29-login_content_injection.patch
 Patch28: mailman-2.1.29-options_content_njection.patch
+Patch29: mailman-2.1.29-cmd_reply_encoding.patch
+Patch30: mailman-CVE-2021-42096-2021-42097.patch
+Patch31: mailman-CVE-2021-44227.patch
 
 License: GPLv2+
 URL: http://www.list.org/
@@ -121,10 +122,11 @@ additional installation steps, these are described in:
 %patch21 -p1
 %patch22 -p1
 %patch24 -p1 -b .python_version
-%patch25 -p0 -b .cve_obj_mime
-%patch26 -p0 -b .bouncer_match
 %patch27 -p0 -b .login_injection
 %patch28 -p0 -b .options_injection
+%patch29 -p0 -b .cmd_reply_encoding
+%patch30 -p1 -b .CVE-2021-42096-2021-42097
+%patch31 -p1 -b .CVE-2021-44227
 
 #cp $RPM_SOURCE_DIR/mailman.INSTALL.REDHAT.in INSTALL.REDHAT.in
 cp %{SOURCE5} INSTALL.REDHAT.in
@@ -578,6 +580,23 @@ exit 0
 %dir %attr(775,root,%{mmgroup}) %{lockdir}
 
 %changelog
+* Wed Jul 26 2023 Martin Osvald <mosvald@redhat.com> - 3:2.1.30-1
+- New version 2.1.30
+- Fixes DMARC support (#2140631)
+
+* Sun Nov 28 2021 Martin Osvald <mosvald@redhat.com> - 3:2.1.29-12.2
+- Fix for CVE-2021-44227
+- Resolves: #2026871
+
+* Tue Nov 09 2021 Martin Osvald <mosvald@redhat.com> - 3:2.1.29-12.1
+- Fix for CVE-2021-42096
+- Fix for CVE-2021-42097
+- Resolves: #2021139, #2020692
+
+* Mon Apr 12 2021 Tomas Korbar <tkorbar@redhat.com> - 3:2.1.29-12
+- Fix encoding handling of command replies
+- Resolves: rhzb#1907323
+
 * Wed Sep 30 2020 Pavel Zhukov <pzhukov@redhat.com> - 3:2.1.29-11
 - Fixes for  CVE-2020-12108 and CVE-2020-15011