Your message dated Mon, 06 Apr 2015 17:20:37 +0000
with message-id <[email protected]>
and subject line Bug#781626: fixed in mailman 1:2.1.13-6
has caused the Debian Bug report #781626,
regarding mailman: CVE-2015-2775: Path traversal vulnerability
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
781626: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=781626
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: mailman
Version: 1:2.1.18-1
Severity: important
Tags: security patch upstream fixed-upstream
Hi,
the following vulnerability was published for mailman.
CVE-2015-2775[0]:
Path traversal vulnerability
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2015-2775
[1] https://bugs.launchpad.net/mailman/+bug/1437145
[2] https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: mailman
Source-Version: 1:2.1.13-6
We believe that the bug you reported is fixed in the latest version of
mailman, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thijs Kinkhorst <[email protected]> (supplier of updated mailman package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Mon, 06 Apr 2015 18:31:36 +0200
Source: mailman
Binary: mailman
Architecture: source amd64
Version: 1:2.1.13-6
Distribution: squeeze-lts
Urgency: high
Maintainer: Mailman for Debian <[email protected]>
Changed-By: Thijs Kinkhorst <[email protected]>
Description:
mailman - Powerful, web-based mailing list manager
Closes: 781626
Changes:
mailman (1:2.1.13-6) squeeze-lts; urgency=high
.
* Upload to squeeze-lts to fix security issue.
* Fix security issue: path traversal through local_part.
Affects installations which use an Exim or Postfix transport
instead of fixed aliases; attacker needs to be able to place
files on the local filesystem.
(CVE-2015-2775, Closes: 781626)
Checksums-Sha1:
6855c79fe2e5c85ad153163452ca594931223773 1619 mailman_2.1.13-6.dsc
807f3059ea6d1837ae35b9f8c09de9396b146a23 110663 mailman_2.1.13-6.debian.tar.gz
a71b7db9e6d0680d3d64e3e5292b78109cfa702b 9676108 mailman_2.1.13-6_amd64.deb
Checksums-Sha256:
d00c7cd10ba6223da16a7e055c9c5ddd61b9cf47df0ede7437e9ba238f4e64f5 1619
mailman_2.1.13-6.dsc
6f054b68af5363bc9ab08e178429cee8ef13d284672f70e5ee0996f96db96cba 110663
mailman_2.1.13-6.debian.tar.gz
ac82dc42d0457d5d14a8b9ebb309e90b5be97f08ff48a258984f3b24f8fe4e02 9676108
mailman_2.1.13-6_amd64.deb
Files:
520404025d9aa0068be6729ebeb46838 1619 mail optional mailman_2.1.13-6.dsc
67ba11645e78fdd4051e565135ee800d 110663 mail optional
mailman_2.1.13-6.debian.tar.gz
2b4b8dc4f86499faa916ef7985c6e106 9676108 mail optional
mailman_2.1.13-6_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAEBCAAGBQJVIrfKAAoJEFb2GnlAHawEHMMH+wVjSRJdDwsIzdB+x5pOdVOH
PsKfOkHMdGU66V69Umqhtd8XuqcdOV78ZPr4Y/a8qNQotmrgYPK7nIGn+++V29d6
phFYsyO2bBJCNrPHoV51t6DeGu+tiRnstvUslFA50dJrSIYmofDzS0MF+BMLOQDB
KehawIZiVQvfrIq/0mSD9WqYZRj0Apf5d+W3AUJNNjd/3Q+ZlgJTI4+HjY587/Rx
yj+L1mzIsTh8kQMXEZL5o2kFSLN2PE2uBGTOHuBLZFOmqhsN/ipUoynvocI2tESL
ucDocjCH4hljteLU7aiepGZ2KaWXcn9crZl0ScsAXF45dF3O3wHE47vSGVzM39E=
=aeh9
-----END PGP SIGNATURE-----
--- End Message ---
