Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 28 Apr 2015 10:50:11 -0700
From: Mark Sapiro <>
To: Kurt Seifried <>,, 
 "" <>
Subject: Re: Limited DoS in mailman (requires non standard config)

On 04/28/2015 10:04 AM, Kurt Seifried wrote:
> So I recently ran into a flaw in mailman where I had imported a text
> list of email addresses of people that wanted to sign up. It turns out
> one of the addresses was in the form "user@...ain.tld/random", not sure
> how that snuck in but anyways. When sending email to this list it fails
> due to that address being present:

What Mailman version is this?

I don't think any recent version would add that address to a list
regardless of how it was attempted to be added.

> from mailman posts log:
> Apr 28 16:46:23 2015 (29704) post to testing from testing-request@XXX,
> size=1786, message-id=<mailman.0.1430239582.16535.testing@XXX>, 1 failures
> from smtp-failure log:
> smtp-failure:Apr 28 16:46:44 2015 (29704) All recipients refused:
> {'': (501, '5.1.3 Bad recipient address syntax')},
> msgid: <CAEo5KB7F3LNCv7Q09ppqBRgUZTaGizyRHx1WS81w8K7S8Yhk7A@YYY>

And I think the only address refused was the one
address. The 'All recipients refused:' refers to all recipients in that
SMTP transaction, not necessarily every list member.

What does your MTA log say about this delivery? And what does Mailman's
'smtp' log say?

Mark Sapiro <>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

Download attachment "signature.asc" of type "application/pgp-signature" (182 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.