RHSA-2020:4667 - Security Advisory

Overview
Updated Packages

Synopsis

Moderate: mailman:2.1 security and bug fix update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the mailman:2.1 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Mailman is a program used to help manage e-mail discussion lists.

Security Fix(es):

mailman: XSS via file attachments in list archives (CVE-2020-12137)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

Red Hat Enterprise Linux for x86_64 8 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
Red Hat Enterprise Linux Server - AUS 8.4 x86_64
Red Hat Enterprise Linux for IBM z Systems 8 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
Red Hat Enterprise Linux for Power, little endian 8 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
Red Hat Enterprise Linux Server - TUS 8.4 x86_64
Red Hat Enterprise Linux for ARM 64 8 aarch64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.4 ppc64le
Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.4 x86_64

Fixes

BZ - 1683399 - /etc/mailman has wrong permissions 0755 instead of 2775
BZ - 1780100 - Module stream mailman:2.1 does not have correct module.md file
BZ - 1805954 - Creating tmp files for systemd on behalf of mailman references legacy directory /var/run/ instead of /run
BZ - 1830007 - CVE-2020-12137 mailman: XSS via file attachments in list archives
BZ - 1837218 - Processing bounces from mailing lists causes oom crash of BounceRunner

CVEs

CVE-2020-12137

References

Note: More recent versions of these packages may be available. Click a package name for more details.

Red Hat Enterprise Linux for x86_64 8

SRPM
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.src.rpm	SHA-256: 450154eb9bb59cb01708ab10f2ce0ddd947a9f0389ae8e1b427c2808dec832ef
x86_64
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.x86_64.rpm	SHA-256: 01f7700acbbb7ccac820156ab94b3a80c169593c40cd7a35e6319fd2b6afbd20
mailman-debuginfo-2.1.29-10.module+el8.3.0+6860+8e47d84b.x86_64.rpm	SHA-256: 4835eefa5f43caed1b4391fa123347b3968bf38d099b513814d477f11745946f
mailman-debugsource-2.1.29-10.module+el8.3.0+6860+8e47d84b.x86_64.rpm	SHA-256: c7df55e8c711720e5d51c1402b30ff38c36b4765943660953f8e1b893e3e38f5

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4

SRPM
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.src.rpm	SHA-256: 450154eb9bb59cb01708ab10f2ce0ddd947a9f0389ae8e1b427c2808dec832ef
x86_64
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.x86_64.rpm	SHA-256: 01f7700acbbb7ccac820156ab94b3a80c169593c40cd7a35e6319fd2b6afbd20
mailman-debuginfo-2.1.29-10.module+el8.3.0+6860+8e47d84b.x86_64.rpm	SHA-256: 4835eefa5f43caed1b4391fa123347b3968bf38d099b513814d477f11745946f
mailman-debugsource-2.1.29-10.module+el8.3.0+6860+8e47d84b.x86_64.rpm	SHA-256: c7df55e8c711720e5d51c1402b30ff38c36b4765943660953f8e1b893e3e38f5

Red Hat Enterprise Linux Server - AUS 8.4

SRPM
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.src.rpm	SHA-256: 450154eb9bb59cb01708ab10f2ce0ddd947a9f0389ae8e1b427c2808dec832ef
x86_64
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.x86_64.rpm	SHA-256: 01f7700acbbb7ccac820156ab94b3a80c169593c40cd7a35e6319fd2b6afbd20
mailman-debuginfo-2.1.29-10.module+el8.3.0+6860+8e47d84b.x86_64.rpm	SHA-256: 4835eefa5f43caed1b4391fa123347b3968bf38d099b513814d477f11745946f
mailman-debugsource-2.1.29-10.module+el8.3.0+6860+8e47d84b.x86_64.rpm	SHA-256: c7df55e8c711720e5d51c1402b30ff38c36b4765943660953f8e1b893e3e38f5

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.src.rpm	SHA-256: 450154eb9bb59cb01708ab10f2ce0ddd947a9f0389ae8e1b427c2808dec832ef
s390x
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.s390x.rpm	SHA-256: cc52e57dfa5d8a5d2be40a21c8f9343ea1f3fb22e3a0e0e265a54f674959f05e
mailman-debuginfo-2.1.29-10.module+el8.3.0+6860+8e47d84b.s390x.rpm	SHA-256: 5597452007472ecd75886ed466e96ece378bfc820993fd07de62c441d8dba8f3
mailman-debugsource-2.1.29-10.module+el8.3.0+6860+8e47d84b.s390x.rpm	SHA-256: 62733459f3c43e6cbab7a7c60dfc567a5b008ac57e0d36e27b661810fb71a58b

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4

SRPM
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.src.rpm	SHA-256: 450154eb9bb59cb01708ab10f2ce0ddd947a9f0389ae8e1b427c2808dec832ef
s390x
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.s390x.rpm	SHA-256: cc52e57dfa5d8a5d2be40a21c8f9343ea1f3fb22e3a0e0e265a54f674959f05e
mailman-debuginfo-2.1.29-10.module+el8.3.0+6860+8e47d84b.s390x.rpm	SHA-256: 5597452007472ecd75886ed466e96ece378bfc820993fd07de62c441d8dba8f3
mailman-debugsource-2.1.29-10.module+el8.3.0+6860+8e47d84b.s390x.rpm	SHA-256: 62733459f3c43e6cbab7a7c60dfc567a5b008ac57e0d36e27b661810fb71a58b

Red Hat Enterprise Linux for Power, little endian 8

SRPM
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.src.rpm	SHA-256: 450154eb9bb59cb01708ab10f2ce0ddd947a9f0389ae8e1b427c2808dec832ef
ppc64le
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.ppc64le.rpm	SHA-256: aac5990975920f8a4b0a7a2cde00a65ab7b68eabe517e3c9ffcb6a2f8e5885fe
mailman-debuginfo-2.1.29-10.module+el8.3.0+6860+8e47d84b.ppc64le.rpm	SHA-256: 35a59f39aa42fe1a92bf83e91bc3c027a2a0f6058b7e80ae499e9fd5e13f1685
mailman-debugsource-2.1.29-10.module+el8.3.0+6860+8e47d84b.ppc64le.rpm	SHA-256: 888c5c997cd1aa9f84f30fc624f14413c4c268eda913a5e3cb59447612177f42

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4

SRPM
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.src.rpm	SHA-256: 450154eb9bb59cb01708ab10f2ce0ddd947a9f0389ae8e1b427c2808dec832ef
ppc64le
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.ppc64le.rpm	SHA-256: aac5990975920f8a4b0a7a2cde00a65ab7b68eabe517e3c9ffcb6a2f8e5885fe
mailman-debuginfo-2.1.29-10.module+el8.3.0+6860+8e47d84b.ppc64le.rpm	SHA-256: 35a59f39aa42fe1a92bf83e91bc3c027a2a0f6058b7e80ae499e9fd5e13f1685
mailman-debugsource-2.1.29-10.module+el8.3.0+6860+8e47d84b.ppc64le.rpm	SHA-256: 888c5c997cd1aa9f84f30fc624f14413c4c268eda913a5e3cb59447612177f42

Red Hat Enterprise Linux Server - TUS 8.4

SRPM
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.src.rpm	SHA-256: 450154eb9bb59cb01708ab10f2ce0ddd947a9f0389ae8e1b427c2808dec832ef
x86_64
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.x86_64.rpm	SHA-256: 01f7700acbbb7ccac820156ab94b3a80c169593c40cd7a35e6319fd2b6afbd20
mailman-debuginfo-2.1.29-10.module+el8.3.0+6860+8e47d84b.x86_64.rpm	SHA-256: 4835eefa5f43caed1b4391fa123347b3968bf38d099b513814d477f11745946f
mailman-debugsource-2.1.29-10.module+el8.3.0+6860+8e47d84b.x86_64.rpm	SHA-256: c7df55e8c711720e5d51c1402b30ff38c36b4765943660953f8e1b893e3e38f5

Red Hat Enterprise Linux for ARM 64 8

SRPM
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.src.rpm	SHA-256: 450154eb9bb59cb01708ab10f2ce0ddd947a9f0389ae8e1b427c2808dec832ef
aarch64
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.aarch64.rpm	SHA-256: 4c136040678ba609a6f26a3be1fe7d5886ed880bf8e8260ec773ed702b4d4c0e
mailman-debuginfo-2.1.29-10.module+el8.3.0+6860+8e47d84b.aarch64.rpm	SHA-256: 3c8b9280e0a91798b4d1e31d5c08b8a406485b409bfef3989ce0699ffd870e03
mailman-debugsource-2.1.29-10.module+el8.3.0+6860+8e47d84b.aarch64.rpm	SHA-256: beca2686301812dc6fd9df7c55af04071d61abbc6a774e6b4ac6bdd673767ad3

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4

SRPM
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.src.rpm	SHA-256: 450154eb9bb59cb01708ab10f2ce0ddd947a9f0389ae8e1b427c2808dec832ef
aarch64
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.aarch64.rpm	SHA-256: 4c136040678ba609a6f26a3be1fe7d5886ed880bf8e8260ec773ed702b4d4c0e
mailman-debuginfo-2.1.29-10.module+el8.3.0+6860+8e47d84b.aarch64.rpm	SHA-256: 3c8b9280e0a91798b4d1e31d5c08b8a406485b409bfef3989ce0699ffd870e03
mailman-debugsource-2.1.29-10.module+el8.3.0+6860+8e47d84b.aarch64.rpm	SHA-256: beca2686301812dc6fd9df7c55af04071d61abbc6a774e6b4ac6bdd673767ad3

Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.4

SRPM
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.src.rpm	SHA-256: 450154eb9bb59cb01708ab10f2ce0ddd947a9f0389ae8e1b427c2808dec832ef
ppc64le
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.ppc64le.rpm	SHA-256: aac5990975920f8a4b0a7a2cde00a65ab7b68eabe517e3c9ffcb6a2f8e5885fe
mailman-debuginfo-2.1.29-10.module+el8.3.0+6860+8e47d84b.ppc64le.rpm	SHA-256: 35a59f39aa42fe1a92bf83e91bc3c027a2a0f6058b7e80ae499e9fd5e13f1685
mailman-debugsource-2.1.29-10.module+el8.3.0+6860+8e47d84b.ppc64le.rpm	SHA-256: 888c5c997cd1aa9f84f30fc624f14413c4c268eda913a5e3cb59447612177f42

Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.4

SRPM
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.src.rpm	SHA-256: 450154eb9bb59cb01708ab10f2ce0ddd947a9f0389ae8e1b427c2808dec832ef
x86_64
mailman-2.1.29-10.module+el8.3.0+6860+8e47d84b.x86_64.rpm	SHA-256: 01f7700acbbb7ccac820156ab94b3a80c169593c40cd7a35e6319fd2b6afbd20
mailman-debuginfo-2.1.29-10.module+el8.3.0+6860+8e47d84b.x86_64.rpm	SHA-256: 4835eefa5f43caed1b4391fa123347b3968bf38d099b513814d477f11745946f
mailman-debugsource-2.1.29-10.module+el8.3.0+6860+8e47d84b.x86_64.rpm	SHA-256: c7df55e8c711720e5d51c1402b30ff38c36b4765943660953f8e1b893e3e38f5

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.