SOLVED [ CPANEL-31659] Security Vulnerability found in Mailman

brianc

brianc

Well-Known Member
May 16, 2003
191
7
168
Does cPanel have an ETA on when you will be patching Mailman to address the following 2 recently discovered security vulnerabilities?

Bug #1873722 “Arbitrary Content Injection via the options login ...” : Bugs : GNU Mailman

An issue similar to CVE - https://www.cvedetails.com/cve/CVE-2018-13796/ exists at different endpoint & param. It can lead to a phishing attack. Steps To Reproduce: 1. Copy and save the following HTML code and open it in any browser. Code: <html> <body> <script>history.pushState('', ''...
bugs.launchpad.net bugs.launchpad.net

Bug #1877379 “Arbitrary Content Injection via the private archiv...” : Bugs : GNU Mailman

This is essentially the same as https://bugs.launchpad.net/mailman/+bug/1873722 except the vector is the private archive login page and the attack only succeeds if the list's roster visibility (private_roster) setting is 'Anyone'. This is fixed by the attached patch.
bugs.launchpad.net bugs.launchpad.net

I have manually applied the to my cPanel servers but I am not getting RPMS have been altered warning messages via email.

Thanks,
Brian
 
cPanelLauren

cPanelLauren

Product Owner II
Staff member
Nov 14, 2017
13,266
1,304
363
Houston
I don't have a date but I do have a case id - CPANEL-31659 - started as updated to 2.1.31 but looks like the other patches have been included for 2.1.33 - the case is currently "In Review" meaning it's done just awaiting a developer to review it. I will do my best to update here when it's released but you can follow the changelogs here: Change Logs - Change Logs - cPanel Documentation as well
 
cPanelLauren

cPanelLauren

Product Owner II
Staff member
Nov 14, 2017
13,266
1,304
363
Houston
You must log in or register to reply here.
Thread starter Similar threads Forum Replies Date
C Malware scanners for cPanel - what options do I have right now? Security 5
J In Progress CPANEL-43160 - cPHulk database issues leading to high cpu user for /usr/sbin/nft --json list ruleset Security 2
K Modsecurity and cpanel questions Security 3
N malicious attacks that changed my cpanel password Security 3
E Script to get cpanel access logs through email Security 2
Similar threads
Malware scanners for cPanel - what options do I have right now?
In Progress CPANEL-43160 - cPHulk database issues leading to high cpu user for /usr/sbin/nft --json list ruleset
Modsecurity and cpanel questions
malicious attacks that changed my cpanel password
Script to get cpanel access logs through email
Top Bottom