CVE-2021-44227

Published: 2 December 2021

In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.

Priority

CVSS 3 base score: 8.8

Status

Package	Release	Status
mailman Launchpad, Ubuntu, Debian	bionic	Released (1:2.1.26-1ubuntu0.6)
	focal	Needed
	trusty	Ignored (out of standard support)
	upstream	Needs triage
	xenial	Needed

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44227
https://ubuntu.com/security/notices/USN-5180-1
NVD
Launchpad
Debian

Bugs

https://bugs.launchpad.net/mailman/+bug/1952384

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›