Your message dated Mon, 06 Apr 2015 19:47:11 +0000
with message-id <[email protected]>
and subject line Bug#781626: fixed in mailman 1:2.1.15-1+deb7u1
has caused the Debian Bug report #781626,
regarding mailman: CVE-2015-2775: Path traversal vulnerability
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
781626: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=781626
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: mailman
Version: 1:2.1.18-1
Severity: important
Tags: security patch upstream fixed-upstream
Hi,
the following vulnerability was published for mailman.
CVE-2015-2775[0]:
Path traversal vulnerability
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2015-2775
[1] https://bugs.launchpad.net/mailman/+bug/1437145
[2] https://mail.python.org/pipermail/mailman-announce/2015-March/000209.html
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: mailman
Source-Version: 1:2.1.15-1+deb7u1
We believe that the bug you reported is fixed in the latest version of
mailman, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thijs Kinkhorst <[email protected]> (supplier of updated mailman package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Mon, 06 Apr 2015 18:17:34 +0200
Source: mailman
Binary: mailman
Architecture: source amd64
Version: 1:2.1.15-1+deb7u1
Distribution: wheezy-security
Urgency: high
Maintainer: Mailman for Debian <[email protected]>
Changed-By: Thijs Kinkhorst <[email protected]>
Description:
mailman - Powerful, web-based mailing list manager
Closes: 781626
Changes:
mailman (1:2.1.15-1+deb7u1) wheezy-security; urgency=high
.
* Fix security issue: path traversal through local_part.
Affects installations which use an Exim or Postfix transport
instead of fixed aliases; attacker needs to be able to place
files on the local filesystem.
(CVE-2015-2775, Closes: 781626)
Checksums-Sha1:
aee14030d2520c20a86296801bd6354080b3dd20 1699 mailman_2.1.15-1+deb7u1.dsc
462ac96331491c76aca0128d8f9ced18c50a75d7 8468107 mailman_2.1.15.orig.tar.gz
fc82154bac4573c6e0d64ad85bbf82969c2f2024 99583
mailman_2.1.15-1+deb7u1.debian.tar.gz
6f15299e7c0a075ce6ebd6e8c484f6d13d4e21fc 10153246
mailman_2.1.15-1+deb7u1_amd64.deb
Checksums-Sha256:
4e4f460bf88ab0bee805ba841ee8ad7ca6c5dbda6b336d03d7b157ece8c301c2 1699
mailman_2.1.15-1+deb7u1.dsc
f355fb3d31772b488449e6f5173dafd31edca93172c307244c791d25d9e2bec8 8468107
mailman_2.1.15.orig.tar.gz
1bd1b8227d0642de2a63106451c8ce81f5499ed165c3b2a1b9c4be8334512218 99583
mailman_2.1.15-1+deb7u1.debian.tar.gz
c8317fc177ceb2723cbb5ec8c76c4852b2c06f9ba39a83b7174f71568f10e284 10153246
mailman_2.1.15-1+deb7u1_amd64.deb
Files:
d865f6501606c842008afe395801defa 1699 mail optional mailman_2.1.15-1+deb7u1.dsc
7d207489e8e9de0727cb334d46029833 8468107 mail optional
mailman_2.1.15.orig.tar.gz
a67a347f2c8b023fa7ad4fa6b6f4ff5b 99583 mail optional
mailman_2.1.15-1+deb7u1.debian.tar.gz
bab8e5b6b8c12a35bb3532178925218d 10153246 mail optional
mailman_2.1.15-1+deb7u1_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAEBCAAGBQJVIrJxAAoJEFb2GnlAHawE7aMH+wfUeW7YntBJ9zbPqQsc7yRC
AZ1+DV9dO2tcI0/cXajrWuY37F7aHYb7PXCCsesvZRcY7StmP7f6puncuAy/QXab
GsU0V0go0ZuR7Eh+QdNcivd+Yh1z0om2nTq5BqpqIfh2M7AqIOk+HsQrcb3c0qFm
vukEITVzGN56D2dynyDjPTUfwoQehX6vL1sMjVQlGhjFOA8GSySXYLPBs6odduPR
CminPU1EEXAPqS/pfCezOVfRHBWM4oWBzGwBfmsKvxqxsoDHDatF2Xry+wiZJsFU
7qeA3b+ktiWN6HoeF5F+7W4vQALCQoqqxqyfvNSCt+KvKmX5b7ELsx915ZMaVsQ=
=pxo1
-----END PGP SIGNATURE-----
--- End Message ---
