Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 24 Feb 2020 11:06:38 -0500
From: Jim Popovitch <>
Subject: Re: mailman 2.x: XSS via file attachments in list

On Mon, 2020-02-24 at 15:34 +0100, Hanno Böck wrote:
> This change is in mailman 2.1.30rc1, but not in any stable release of
> mailman.

Just for some added info, Mailman v2.1.30 is almost released, the holdup
is with some language translations.  Mailman v2.1.30 will be the last of
the Mailman v2 releases as primary development and effort has long
shifted to Mailman v3. Further, the Mailman v2 branch is tied to Python
v2, which is now EOL by the fine Python folk.

Once Mailman v2.1.30 is release, I'm sure the various distributions will
pull the commit and merge the particulars into their release branches,
and that will surely include this XSS fix. 

I'm not a formal Mailman Developer, but as a contributor and member of
the general Mailman Community I say Thank You to Hanno for identifying
and reporting  this vulnerability.

-Jim P.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.