SUSE-SU-2020:1301-1

Details

Description of the patch:

This update for mailman fixes the following issues:

Security issue fixed:

CVE-2020-12108: Fixed a content injection bug (bsc#1171363).
CVE-2020-12137: Fixed a XSS vulnerability caused by MIME type confusion (bsc#1170558).

Non-security issue fixed:

Fixed rights and ownership on /var/lib/mailman/archives (bsc#1167068).
Don't default to invalid hosts for DEFAULT_EMAIL_HOST (bsc#682920).

Affected Packages

mailman

SUSE Enterprise Storage 5SUSE Linux Enterprise Server 12 SP1-LTSSSUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP2-LTSSSUSE Linux Enterprise Server 12 SP3-BCL

Fixed in:

2.1.17-3.20.1

References

ADVISORY

https://bugzilla.suse.com/1167068

ADVISORY

https://bugzilla.suse.com/1170558

ADVISORY

https://bugzilla.suse.com/1171363

ADVISORY

https://bugzilla.suse.com/682920

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2020-May/006830.html

ADVISORY

https://www.suse.com/security/cve/CVE-2020-12108/

ADVISORY

https://www.suse.com/security/cve/CVE-2020-12137/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2020/suse-su-20201301-1/