Your message dated Thu, 21 Feb 2008 23:47:04 +0000
with message-id <[EMAIL PROTECTED]>
and subject line Bug#450399: fixed in mailman 1:2.1.10~b3-1
has caused the Debian Bug report #450399,
regarding mailman HTML archives drop MIME parts with no headers
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [EMAIL PROTECTED]
immediately.)
--
450399: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=450399
Debian Bug Tracking System
Contact [EMAIL PROTECTED] with problems
--- Begin Message ---
Package: mailman
Version: 2.1.9-8
Severity: normal
Tags: patch
Mailman appears to create a faulty HTML archive page of any message
which has a part with no header (most MIME parts have at least a
Content-Type: header, but RFC 2045, section 5.2 suggests that it's not
a requirement). Any headerless MIME part is stripped and not
displayed.
This is discussed upstream here:
https://sourceforge.net/tracker/index.php?func=detail&aid=759841&group_id=103&atid=100103
The word is that it's going to be fixed in mailman 2.1.10, though that
isn't even in beta yet.
The patch against 2.1.9 seems pretty minimal:
--- Scrubber.py.orig 2007-11-06 21:15:30.000000000 -0500
+++ Scrubber.py 2007-11-06 21:16:07.000000000 -0500
@@ -342,7 +342,8 @@
text = []
for part in msg.walk():
# TK: bug-id 1099138 and multipart
- if not part or part.is_multipart():
+ # MAS test payload - if part may fail if there are no headers.
+ if not part._payload or part.is_multipart():
continue
# All parts should be scrubbed to text/plain by now.
partctype = part.get_content_type()
Thanks for maintaining mailman in debian.
Regards,
--dkg
-- System Information:
Debian Release: lenny/sid
APT prefers testing
APT policy: (500, 'testing'), (200, 'unstable'), (101, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.6.22-2-686 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
--- End Message ---
--- Begin Message ---
Source: mailman
Source-Version: 1:2.1.10~b3-1
We believe that the bug you reported is fixed in the latest version of
mailman, which is due to be installed in the Debian FTP archive:
mailman_2.1.10~b3-1.diff.gz
to pool/main/m/mailman/mailman_2.1.10~b3-1.diff.gz
mailman_2.1.10~b3-1.dsc
to pool/main/m/mailman/mailman_2.1.10~b3-1.dsc
mailman_2.1.10~b3-1_i386.deb
to pool/main/m/mailman/mailman_2.1.10~b3-1_i386.deb
mailman_2.1.10~b3.orig.tar.gz
to pool/main/m/mailman/mailman_2.1.10~b3.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thijs Kinkhorst <[EMAIL PROTECTED]> (supplier of updated mailman package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Fri, 22 Feb 2008 00:09:11 +0100
Source: mailman
Binary: mailman
Architecture: source i386
Version: 1:2.1.10~b3-1
Distribution: unstable
Urgency: low
Maintainer: Mailman for Debian <[EMAIL PROTECTED]>
Changed-By: Thijs Kinkhorst <[EMAIL PROTECTED]>
Description:
mailman - Powerful, web-based mailing list manager
Closes: 260224 446257 450399
Changes:
mailman (1:2.1.10~b3-1) unstable; urgency=low
.
* New upstream beta release.
+ Restricts XSS by list admins, CVE-2008-0564.
+ Obsoletes 56_fix_de_broken_links.patch.
+ Obsoletes 81_backport_export.dpatch.
+ Makes list handling case sensitivity consistent (closes: #446257).
+ Archives do not drop headerless mime parts (Closes: #450399).
+ check_perms checks more perms (Closes: #260224).
Files:
b124db23f70873bf34a63e504cbab239 1227 mail optional mailman_2.1.10~b3-1.dsc
853ac2f5e92ba3d19bbd770650cb7438 7826136 mail optional
mailman_2.1.10~b3.orig.tar.gz
b43bc402f64fff2833dc8fc65e7f2f28 137765 mail optional
mailman_2.1.10~b3-1.diff.gz
dd4328d701af27f5bcd20647a7d8b6dc 9205544 mail optional
mailman_2.1.10~b3-1_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iQEVAwUBR74LfWz0hbPcukPfAQI41wgAq7YRb17QJgDIZIqB+kRZBXUX+lq9HtsS
GWFiGcMUk30Q5hXKCQ647fAQ2SsayWyL1+DbAAz4AZynstWpx/BAubPFkMKBE9Qw
Ke8xfLI39U6UnqryFJRDYEV7ePn/tXFZ+jyjdNBUrO6LXpcyZZ+X90nlejkf4EKp
OCkqgg8gNfpFbEjCQ4I2T2r2HzD31Zbb9nvaHvsJwXNGpjFyv5/owJcwyJ5VeF2q
PHiqqCxbczUwb6VLeILLQu6KVD2phRihoRlEmiJqVJkEc3QiwdCrPv5pa7Ld4I6N
r9EOzmiwjlQ3ej+5jS8sx0dGqxJMF/usuex5As8iGDyZPpE4zAT5nw==
=6yQt
-----END PGP SIGNATURE-----
--- End Message ---
