Compare commits
No commits in common. "stream-mailman-2.1-rhel-8.5.0" and "c8-stream-2.1" have entirely different histories.
stream-mai
...
c8-stream-
2
.gitignore
vendored
2
.gitignore
vendored
@ -1 +1 @@
|
|||||||
SOURCES/mailman-2.1.29.tgz
|
SOURCES/mailman-2.1.30.tgz
|
||||||
|
@ -1 +1 @@
|
|||||||
40fe97974a6f0805a01d55c6944565f238778238 mailman-2.1.29.tgz
|
01f3c33d057b771fd9bac3684f2f9be1d1000254 SOURCES/mailman-2.1.30.tgz
|
||||||
|
129
SOURCES/mailman-CVE-2021-42096-2021-42097.patch
Normal file
129
SOURCES/mailman-CVE-2021-42096-2021-42097.patch
Normal file
@ -0,0 +1,129 @@
|
|||||||
|
diff --git a/Mailman/CSRFcheck.py b/Mailman/CSRFcheck.py
|
||||||
|
index a1e78d9..0940b7e 100644
|
||||||
|
--- a/Mailman/CSRFcheck.py
|
||||||
|
+++ b/Mailman/CSRFcheck.py
|
||||||
|
@@ -18,11 +18,13 @@
|
||||||
|
""" Cross-Site Request Forgery checker """
|
||||||
|
|
||||||
|
import time
|
||||||
|
+import urllib
|
||||||
|
import marshal
|
||||||
|
import binascii
|
||||||
|
|
||||||
|
from Mailman import mm_cfg
|
||||||
|
-from Mailman.Utils import sha_new
|
||||||
|
+from Mailman.Logging.Syslog import syslog
|
||||||
|
+from Mailman.Utils import UnobscureEmail, sha_new
|
||||||
|
|
||||||
|
keydict = {
|
||||||
|
'user': mm_cfg.AuthUser,
|
||||||
|
@@ -37,6 +39,10 @@ keydict = {
|
||||||
|
def csrf_token(mlist, contexts, user=None):
|
||||||
|
""" create token by mailman cookie generation algorithm """
|
||||||
|
|
||||||
|
+ if user:
|
||||||
|
+ # Unmunge a munged email address.
|
||||||
|
+ user = UnobscureEmail(urllib.unquote(user))
|
||||||
|
+
|
||||||
|
for context in contexts:
|
||||||
|
key, secret = mlist.AuthContextInfo(context, user)
|
||||||
|
if key:
|
||||||
|
@@ -49,9 +55,8 @@ def csrf_token(mlist, contexts, user=None):
|
||||||
|
token = binascii.hexlify(marshal.dumps((issued, keymac)))
|
||||||
|
return token
|
||||||
|
|
||||||
|
-def csrf_check(mlist, token):
|
||||||
|
+def csrf_check(mlist, token, options_user=None):
|
||||||
|
""" check token by mailman cookie validation algorithm """
|
||||||
|
-
|
||||||
|
try:
|
||||||
|
issued, keymac = marshal.loads(binascii.unhexlify(token))
|
||||||
|
key, received_mac = keymac.split(':', 1)
|
||||||
|
@@ -62,6 +67,17 @@ def csrf_check(mlist, token):
|
||||||
|
key, user = key.split('+', 1)
|
||||||
|
else:
|
||||||
|
user = None
|
||||||
|
+ if user:
|
||||||
|
+ # This is for CVE-2021-42097. The token is a user token because
|
||||||
|
+ # of the fix for CVE-2021-42096 but it must match the user for
|
||||||
|
+ # whom the options page is requested.
|
||||||
|
+ raw_user = UnobscureEmail(urllib.unquote(user))
|
||||||
|
+ if options_user and options_user != raw_user:
|
||||||
|
+ syslog('mischief',
|
||||||
|
+ 'Form for user %s submitted with CSRF token '
|
||||||
|
+ 'issued for %s.',
|
||||||
|
+ options_user, raw_user)
|
||||||
|
+ return False
|
||||||
|
context = keydict.get(key)
|
||||||
|
key, secret = mlist.AuthContextInfo(context, user)
|
||||||
|
assert key
|
||||||
|
diff --git a/Mailman/Cgi/options.py b/Mailman/Cgi/options.py
|
||||||
|
index ee2293e..472a02b 100644
|
||||||
|
--- a/Mailman/Cgi/options.py
|
||||||
|
+++ b/Mailman/Cgi/options.py
|
||||||
|
@@ -54,9 +54,6 @@ except NameError:
|
||||||
|
True = 1
|
||||||
|
False = 0
|
||||||
|
|
||||||
|
-AUTH_CONTEXTS = (mm_cfg.AuthListAdmin, mm_cfg.AuthSiteAdmin,
|
||||||
|
- mm_cfg.AuthListModerator, mm_cfg.AuthUser)
|
||||||
|
-
|
||||||
|
|
||||||
|
def main():
|
||||||
|
global _
|
||||||
|
@@ -124,15 +121,6 @@ def main():
|
||||||
|
print doc.Format()
|
||||||
|
return
|
||||||
|
|
||||||
|
- if set(params) - set(safe_params):
|
||||||
|
- csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
|
||||||
|
- else:
|
||||||
|
- csrf_checked = True
|
||||||
|
- # if password is present, void cookie to force password authentication.
|
||||||
|
- if cgidata.getfirst('password'):
|
||||||
|
- os.environ['HTTP_COOKIE'] = ''
|
||||||
|
- csrf_checked = True
|
||||||
|
-
|
||||||
|
# Set the language for the page. If we're coming from the listinfo cgi,
|
||||||
|
# we might have a 'language' key in the cgi data. That was an explicit
|
||||||
|
# preference to view the page in, so we should honor that here. If that's
|
||||||
|
@@ -169,6 +157,16 @@ def main():
|
||||||
|
user = user[-1].strip()
|
||||||
|
|
||||||
|
# Avoid cross-site scripting attacks
|
||||||
|
+ if set(params) - set(safe_params):
|
||||||
|
+ csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
|
||||||
|
+ Utils.UnobscureEmail(urllib.unquote(user)))
|
||||||
|
+ else:
|
||||||
|
+ csrf_checked = True
|
||||||
|
+ # if password is present, void cookie to force password authentication.
|
||||||
|
+ if cgidata.getfirst('password'):
|
||||||
|
+ os.environ['HTTP_COOKIE'] = ''
|
||||||
|
+ csrf_checked = True
|
||||||
|
+
|
||||||
|
safeuser = Utils.websafe(user)
|
||||||
|
try:
|
||||||
|
Utils.ValidateEmail(user)
|
||||||
|
@@ -868,8 +866,9 @@ def options_page(mlist, doc, user, cpuser, userlang, message=''):
|
||||||
|
mlist.FormatButton('othersubs',
|
||||||
|
_('List my other subscriptions')))
|
||||||
|
replacements['<mm-form-start>'] = (
|
||||||
|
+ # Always make the CSRF token for the user. CVE-2021-42096
|
||||||
|
mlist.FormatFormStart('options', user, mlist=mlist,
|
||||||
|
- contexts=AUTH_CONTEXTS, user=user))
|
||||||
|
+ contexts=[mm_cfg.AuthUser], user=user))
|
||||||
|
replacements['<mm-user>'] = user
|
||||||
|
replacements['<mm-presentable-user>'] = presentable_user
|
||||||
|
replacements['<mm-email-my-pw>'] = mlist.FormatButton(
|
||||||
|
diff --git a/Mailman/SecurityManager.py b/Mailman/SecurityManager.py
|
||||||
|
index 9b7f03f..e9e5ce5 100644
|
||||||
|
--- a/Mailman/SecurityManager.py
|
||||||
|
+++ b/Mailman/SecurityManager.py
|
||||||
|
@@ -104,6 +104,7 @@ class SecurityManager:
|
||||||
|
if user is None:
|
||||||
|
# A bad system error
|
||||||
|
raise TypeError, 'No user supplied for AuthUser context'
|
||||||
|
+ user = Utils.UnobscureEmail(urllib.unquote(user))
|
||||||
|
secret = self.getMemberPassword(user)
|
||||||
|
userdata = urllib.quote(Utils.ObscureEmail(user), safe='')
|
||||||
|
key += 'user+%s' % userdata
|
82
SOURCES/mailman-CVE-2021-44227.patch
Normal file
82
SOURCES/mailman-CVE-2021-44227.patch
Normal file
@ -0,0 +1,82 @@
|
|||||||
|
diff --git a/Mailman/CSRFcheck.py b/Mailman/CSRFcheck.py
|
||||||
|
index 24e3e11..81998cf 100644
|
||||||
|
--- a/Mailman/CSRFcheck.py
|
||||||
|
+++ b/Mailman/CSRFcheck.py
|
||||||
|
@@ -55,7 +55,7 @@ def csrf_token(mlist, contexts, user=None):
|
||||||
|
token = binascii.hexlify(marshal.dumps((issued, keymac)))
|
||||||
|
return token
|
||||||
|
|
||||||
|
-def csrf_check(mlist, token, options_user=None):
|
||||||
|
+def csrf_check(mlist, token, cgi_user=None):
|
||||||
|
""" check token by mailman cookie validation algorithm """
|
||||||
|
try:
|
||||||
|
issued, keymac = marshal.loads(binascii.unhexlify(token))
|
||||||
|
@@ -67,12 +67,25 @@ def csrf_check(mlist, token, options_user=None):
|
||||||
|
key, user = key.split('+', 1)
|
||||||
|
else:
|
||||||
|
user = None
|
||||||
|
+ # Don't allow unprivileged tokens for admin or admindb.
|
||||||
|
+ if cgi_user == 'admin':
|
||||||
|
+ if key not in ('admin', 'site'):
|
||||||
|
+ syslog('mischief',
|
||||||
|
+ 'admin form submitted with CSRF token issued for %s.',
|
||||||
|
+ key + '+' + user if user else key)
|
||||||
|
+ return False
|
||||||
|
+ elif cgi_user == 'admindb':
|
||||||
|
+ if key not in ('moderator', 'admin', 'site'):
|
||||||
|
+ syslog('mischief',
|
||||||
|
+ 'admindb form submitted with CSRF token issued for %s.',
|
||||||
|
+ key + '+' + user if user else key)
|
||||||
|
+ return False
|
||||||
|
if user:
|
||||||
|
# This is for CVE-2021-42097. The token is a user token because
|
||||||
|
# of the fix for CVE-2021-42096 but it must match the user for
|
||||||
|
# whom the options page is requested.
|
||||||
|
raw_user = UnobscureEmail(urllib.unquote(user))
|
||||||
|
- if options_user and options_user != raw_user:
|
||||||
|
+ if cgi_user and cgi_user != raw_user:
|
||||||
|
syslog('mischief',
|
||||||
|
'Form for user %s submitted with CSRF token '
|
||||||
|
'issued for %s.',
|
||||||
|
diff --git a/Mailman/Cgi/admin.py b/Mailman/Cgi/admin.py
|
||||||
|
index d2577b5..7c600df 100644
|
||||||
|
--- a/Mailman/Cgi/admin.py
|
||||||
|
+++ b/Mailman/Cgi/admin.py
|
||||||
|
@@ -107,7 +107,8 @@ def main():
|
||||||
|
'legend']
|
||||||
|
params = cgidata.keys()
|
||||||
|
if set(params) - set(safe_params):
|
||||||
|
- csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
|
||||||
|
+ csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
|
||||||
|
+ 'admin')
|
||||||
|
else:
|
||||||
|
csrf_checked = True
|
||||||
|
# if password is present, void cookie to force password authentication.
|
||||||
|
diff --git a/Mailman/Cgi/admindb.py b/Mailman/Cgi/admindb.py
|
||||||
|
index 58bb357..c152501 100644
|
||||||
|
--- a/Mailman/Cgi/admindb.py
|
||||||
|
+++ b/Mailman/Cgi/admindb.py
|
||||||
|
@@ -144,7 +144,8 @@ def main():
|
||||||
|
safe_params = ['adminpw', 'admlogin', 'msgid', 'sender', 'details']
|
||||||
|
params = cgidata.keys()
|
||||||
|
if set(params) - set(safe_params):
|
||||||
|
- csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
|
||||||
|
+ csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
|
||||||
|
+ 'admindb')
|
||||||
|
else:
|
||||||
|
csrf_checked = True
|
||||||
|
# if password is present, void cookie to force password authentication.
|
||||||
|
diff --git a/Mailman/Cgi/edithtml.py b/Mailman/Cgi/edithtml.py
|
||||||
|
index 1dd9e87..170e811 100644
|
||||||
|
--- a/Mailman/Cgi/edithtml.py
|
||||||
|
+++ b/Mailman/Cgi/edithtml.py
|
||||||
|
@@ -111,7 +111,8 @@ def main():
|
||||||
|
safe_params = ['VARHELP', 'adminpw', 'admlogin']
|
||||||
|
params = cgidata.keys()
|
||||||
|
if set(params) - set(safe_params):
|
||||||
|
- csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
|
||||||
|
+ csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
|
||||||
|
+ 'admin')
|
||||||
|
else:
|
||||||
|
csrf_checked = True
|
||||||
|
# if password is present, void cookie to force password authentication.
|
@ -2,12 +2,12 @@
|
|||||||
%global __os_install_post %(echo '%{__os_install_post}' | sed -e 's!/usr/lib[^[:space:]]*/brp-python-bytecompile[[:space:]].*$!!g')
|
%global __os_install_post %(echo '%{__os_install_post}' | sed -e 's!/usr/lib[^[:space:]]*/brp-python-bytecompile[[:space:]].*$!!g')
|
||||||
Summary: Mailing list manager with built in Web access
|
Summary: Mailing list manager with built in Web access
|
||||||
Name: mailman
|
Name: mailman
|
||||||
Version: 2.1.29
|
Version: 2.1.30
|
||||||
Release: 12%{?dist}
|
Release: 1%{?dist}
|
||||||
Epoch: 3
|
Epoch: 3
|
||||||
Group: Applications/Internet
|
Group: Applications/Internet
|
||||||
Source0: ftp://ftp.gnu.org/pub/gnu/mailman/mailman-%{version}.tgz
|
Source0: ftp://ftp.gnu.org/pub/gnu/mailman/mailman-%{version}.tgz
|
||||||
#Source0: http://prdownloads.sourceforge.net/mailman/mailman-%{version}.tgz
|
#Source0: http://prdownloads.sourceforge.net/mailman/mailman-%%{version}.tgz
|
||||||
Source1: mm_cfg.py
|
Source1: mm_cfg.py
|
||||||
Source3: httpd-mailman.conf
|
Source3: httpd-mailman.conf
|
||||||
Source4: mailman.logrotate
|
Source4: mailman.logrotate
|
||||||
@ -29,11 +29,11 @@ Patch13: mailman-2.1.9-unicode.patch
|
|||||||
Patch21: mailman-2.1.13-env-python.patch
|
Patch21: mailman-2.1.13-env-python.patch
|
||||||
Patch22: mailman-2.1.15-check_perms.patch
|
Patch22: mailman-2.1.15-check_perms.patch
|
||||||
Patch24: mailman-specify_python_version.patch
|
Patch24: mailman-specify_python_version.patch
|
||||||
Patch25: mailman-CVE-2020-12137.patch
|
|
||||||
Patch26: mailman-bouncer_oom_crash.patch
|
|
||||||
Patch27: mailman-2.1.29-login_content_injection.patch
|
Patch27: mailman-2.1.29-login_content_injection.patch
|
||||||
Patch28: mailman-2.1.29-options_content_njection.patch
|
Patch28: mailman-2.1.29-options_content_njection.patch
|
||||||
Patch29: mailman-2.1.29-cmd_reply_encoding.patch
|
Patch29: mailman-2.1.29-cmd_reply_encoding.patch
|
||||||
|
Patch30: mailman-CVE-2021-42096-2021-42097.patch
|
||||||
|
Patch31: mailman-CVE-2021-44227.patch
|
||||||
|
|
||||||
License: GPLv2+
|
License: GPLv2+
|
||||||
URL: http://www.list.org/
|
URL: http://www.list.org/
|
||||||
@ -122,11 +122,11 @@ additional installation steps, these are described in:
|
|||||||
%patch21 -p1
|
%patch21 -p1
|
||||||
%patch22 -p1
|
%patch22 -p1
|
||||||
%patch24 -p1 -b .python_version
|
%patch24 -p1 -b .python_version
|
||||||
%patch25 -p0 -b .cve_obj_mime
|
|
||||||
%patch26 -p0 -b .bouncer_match
|
|
||||||
%patch27 -p0 -b .login_injection
|
%patch27 -p0 -b .login_injection
|
||||||
%patch28 -p0 -b .options_injection
|
%patch28 -p0 -b .options_injection
|
||||||
%patch29 -p0 -b .cmd_reply_encoding
|
%patch29 -p0 -b .cmd_reply_encoding
|
||||||
|
%patch30 -p1 -b .CVE-2021-42096-2021-42097
|
||||||
|
%patch31 -p1 -b .CVE-2021-44227
|
||||||
|
|
||||||
#cp $RPM_SOURCE_DIR/mailman.INSTALL.REDHAT.in INSTALL.REDHAT.in
|
#cp $RPM_SOURCE_DIR/mailman.INSTALL.REDHAT.in INSTALL.REDHAT.in
|
||||||
cp %{SOURCE5} INSTALL.REDHAT.in
|
cp %{SOURCE5} INSTALL.REDHAT.in
|
||||||
@ -580,6 +580,19 @@ exit 0
|
|||||||
%dir %attr(775,root,%{mmgroup}) %{lockdir}
|
%dir %attr(775,root,%{mmgroup}) %{lockdir}
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed Jul 26 2023 Martin Osvald <mosvald@redhat.com> - 3:2.1.30-1
|
||||||
|
- New version 2.1.30
|
||||||
|
- Fixes DMARC support (#2140631)
|
||||||
|
|
||||||
|
* Sun Nov 28 2021 Martin Osvald <mosvald@redhat.com> - 3:2.1.29-12.2
|
||||||
|
- Fix for CVE-2021-44227
|
||||||
|
- Resolves: #2026871
|
||||||
|
|
||||||
|
* Tue Nov 09 2021 Martin Osvald <mosvald@redhat.com> - 3:2.1.29-12.1
|
||||||
|
- Fix for CVE-2021-42096
|
||||||
|
- Fix for CVE-2021-42097
|
||||||
|
- Resolves: #2021139, #2020692
|
||||||
|
|
||||||
* Mon Apr 12 2021 Tomas Korbar <tkorbar@redhat.com> - 3:2.1.29-12
|
* Mon Apr 12 2021 Tomas Korbar <tkorbar@redhat.com> - 3:2.1.29-12
|
||||||
- Fix encoding handling of command replies
|
- Fix encoding handling of command replies
|
||||||
- Resolves: rhzb#1907323
|
- Resolves: rhzb#1907323
|
@ -1,14 +0,0 @@
|
|||||||
=== modified file 'Mailman/Handlers/Scrubber.py'
|
|
||||||
--- Mailman/Handlers/Scrubber.py 2018-06-17 23:47:34 +0000
|
|
||||||
+++ Mailman/Handlers/Scrubber.py 2018-11-10 18:57:54 +0000
|
|
||||||
@@ -87,6 +87,9 @@
|
|
||||||
all = guess_all_extensions(ctype, strict=False)
|
|
||||||
if ext in all:
|
|
||||||
return ext
|
|
||||||
+ if ctype.lower == 'application/octet-stream':
|
|
||||||
+ # For this type, all[0] is '.obj'. '.bin' is better.
|
|
||||||
+ return '.bin'
|
|
||||||
return all and all[0]
|
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -1,78 +0,0 @@
|
|||||||
--- Mailman/Bouncers/SimpleMatch.py 2018-06-17 23:47:34 +0000
|
|
||||||
+++ Mailman/Bouncers/SimpleMatch.py 2020-01-17 00:03:34 +0000
|
|
||||||
@@ -25,6 +25,9 @@
|
|
||||||
def _c(pattern):
|
|
||||||
return re.compile(pattern, re.IGNORECASE)
|
|
||||||
|
|
||||||
+# Pattern to match any valid email address and not much more.
|
|
||||||
+VALID = _c(r'[\x21-\x3d\x3f\x41-\x7e]+@[a-z0-9._]+')
|
|
||||||
+
|
|
||||||
# This is a list of tuples of the form
|
|
||||||
#
|
|
||||||
# (start cre, end cre, address cre)
|
|
||||||
@@ -227,4 +230,4 @@
|
|
||||||
break
|
|
||||||
if addrs:
|
|
||||||
break
|
|
||||||
- return addrs.keys()
|
|
||||||
+ return [x for x in addrs.keys() if VALID.match(x)]
|
|
||||||
|
|
||||||
=== modified file 'Mailman/Bouncers/SimpleWarning.py'
|
|
||||||
--- Mailman/Bouncers/SimpleWarning.py 2018-06-17 23:47:34 +0000
|
|
||||||
+++ Mailman/Bouncers/SimpleWarning.py 2020-01-17 00:03:34 +0000
|
|
||||||
@@ -17,9 +17,10 @@
|
|
||||||
|
|
||||||
"""Recognizes simple heuristically delimited warnings."""
|
|
||||||
|
|
||||||
+import email
|
|
||||||
+
|
|
||||||
from Mailman.Bouncers.BouncerAPI import Stop
|
|
||||||
from Mailman.Bouncers.SimpleMatch import _c
|
|
||||||
-from Mailman.Bouncers.SimpleMatch import process as _process
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@@ -67,8 +68,25 @@
|
|
||||||
|
|
||||||
|
|
||||||
def process(msg):
|
|
||||||
- if _process(msg, patterns):
|
|
||||||
- # It's a recognized warning so stop now
|
|
||||||
- return Stop
|
|
||||||
- else:
|
|
||||||
- return []
|
|
||||||
+ # We used to just import process from SimpleMatch, but with the change in
|
|
||||||
+ # SimpleMatch to return only vaild addresses, that doesn't work any more.
|
|
||||||
+ # So, we copy most of the process from SimpleMatch here.
|
|
||||||
+ addrs = {}
|
|
||||||
+ for scre, ecre, acre in patterns:
|
|
||||||
+ state = 0
|
|
||||||
+ for line in email.Iterators.body_line_iterator(msg, decode=True):
|
|
||||||
+ if state == 0:
|
|
||||||
+ if scre.search(line):
|
|
||||||
+ state = 1
|
|
||||||
+ if state == 1:
|
|
||||||
+ mo = acre.search(line)
|
|
||||||
+ if mo:
|
|
||||||
+ addr = mo.group('addr')
|
|
||||||
+ if addr:
|
|
||||||
+ addrs[addr.strip('<>')] = 1
|
|
||||||
+ elif ecre.search(line):
|
|
||||||
+ break
|
|
||||||
+ if addrs:
|
|
||||||
+ # It's a recognized warning so stop now
|
|
||||||
+ return Stop
|
|
||||||
+ return []
|
|
||||||
|
|
||||||
--- Mailman/Bouncers/SimpleMatch.py 2020-01-17 00:03:34 +0000
|
|
||||||
+++ Mailman/Bouncers/SimpleMatch.py 2020-01-17 03:25:09 +0000
|
|
||||||
@@ -26,7 +26,7 @@
|
|
||||||
return re.compile(pattern, re.IGNORECASE)
|
|
||||||
|
|
||||||
# Pattern to match any valid email address and not much more.
|
|
||||||
-VALID = _c(r'[\x21-\x3d\x3f\x41-\x7e]+@[a-z0-9._]+')
|
|
||||||
+VALID = _c(r'^[\x21-\x3d\x3f\x41-\x7e]+@[a-z0-9._]+$')
|
|
||||||
|
|
||||||
# This is a list of tuples of the form
|
|
||||||
#
|
|
||||||
|
|
Loading…
Reference in New Issue
Block a user