Fedora Legacy Test Update Notification: mailman

[Dominic Hargreaves]

---------------------------------------------------------------------
Fedora Legacy Test Update Notification
FEDORALEGACY-2005-2419
Bugzilla https://bugzilla.fedora.us/show_bug.cgi?id=2419
2005-02-11
---------------------------------------------------------------------


Name        : mailman
Versions    : rh9: mailman-2.1.1-8.legacy
Versions    : fc1: mailman-2.1.5-8.legacy
Summary     : Mailing list manager with built in Web access.
Description :
Mailman is software to help manage email discussion lists, much like
Majordomo and Smartmail. Unlike most similar products, Mailman gives
each mailing list a webpage, and allows users to subscribe,
unsubscribe, etc. over the Web. Even the list manager can administer
his or her list entirely from the Web. Mailman also integrates most
things people want to do with mailing lists, including archiving, mail
<-> news gateways, and so on.


---------------------------------------------------------------------
Update Information:

Updated mailman packages that correct a mailman security issue are now
available.

A flaw in the true_path function of Mailman was discovered. A remote
attacker who is a member of a private mailman list could use a carefully
crafted URL and gain access to arbitrary files on the server. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2005-0202 to this issue.

Note: Mailman installations running on Apache 2.0-based servers are not
vulnerable to this issue.

Users of mailman should update to these erratum packages that contain a
patch and are not vulnerable to this issue.

---------------------------------------------------------------------
Changelogs


rh9:
* Thu Feb 10 2005 Dominic Hargreaves <dom at earth.li> 3:2.1.1-8.legacy

- Fix CAN-2005-0202 (password exposure)

fc1:
* Thu Feb 10 2005 Dominic Hargreaves <dom at earth.li> - 3:2.1.5-8.legacy

- Added python, autoconf and automake build prerequisites

* Thu Feb 10 2005 Jeff Sheltren <sheltren at cs.ucsb.edu> - 3:2.1.5-7.legacy

- Patch CAN-2005-0202 (using RHEL patch)
- Add legacy release tag

---------------------------------------------------------------------
This update can be downloaded from:
  http://download.fedoralegacy.org/
(sha1sums)

rh9:
25326c2d67924ff669ec8577e1f3da8090c7a94c  redhat/9/updates-testing/SRPMS/mailman-2.1.1-8.legacy.src.rpm
df9db43206a4d4394d2ca9a0ebf473b4520df5ec  redhat/9/updates-testing/i386/mailman-2.1.1-8.legacy.i386.rpm
ae868e1bf44d1e3fa94b00e91b7df385643daa37  fedora/1/updates-testing/SRPMS/mailman-2.1.5-8.legacy.src.rpm
556f7cd0bf69c4d72c6a5630523d0609f9b85aba  fedora/1/updates-testing/i386/mailman-2.1.5-8.legacy.i386.rpm

---------------------------------------------------------------------
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
URL: <http://listman.redhat.com/archives/fedora-legacy-list/attachments/20050211/5f2dc94f/attachment.sig>