tags 599833 + patch thanks Upstream released new version for fixing this bug.
[Mailman-Announce] Mailman 2.1.14 released. http://mail.python.org/pipermail/mailman-announce/2010-September/000154.html [Mailman-Announce] Mailman security patch. http://mail.python.org/pipermail/mailman-announce/2010-September/000151.html Two potential XSS vulnerabilities have been identified and fixed. http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1262 fix patch attached. -- Regards, dai GPG Fingerprint = 0B29 D88E 42E6 B765 B8D8 EA50 7839 619D D439 668E
=== modified file 'Mailman/Cgi/listinfo.py'
--- Mailman/Cgi/listinfo.py 2010-06-24 04:09:34 +0000
+++ Mailman/Cgi/listinfo.py 2010-09-09 15:16:57 +0000
@@ -1,4 +1,4 @@
-# Copyright (C) 1998-2009 by the Free Software Foundation, Inc.
+# Copyright (C) 1998-2010 by the Free Software Foundation, Inc.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
@@ -97,7 +97,7 @@
else:
advertised.append((mlist.GetScriptURL('listinfo'),
mlist.real_name,
- mlist.description))
+ Utils.websafe(mlist.description)))
if msg:
greeting = FontAttr(msg, color="ff5060", size="+1")
else:
=== modified file 'Mailman/HTMLFormatter.py'
--- Mailman/HTMLFormatter.py 2008-02-03 19:27:07 +0000
+++ Mailman/HTMLFormatter.py 2010-09-09 15:16:57 +0000
@@ -1,4 +1,4 @@
-# Copyright (C) 1998-2008 by the Free Software Foundation, Inc.
+# Copyright (C) 1998-2010 by the Free Software Foundation, Inc.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
@@ -383,8 +383,9 @@
'<mm-mailman-footer>' : self.GetMailmanFooter(),
'<mm-list-name>' : self.real_name,
'<mm-email-user>' : self._internal_name,
- '<mm-list-description>' : self.description,
- '<mm-list-info>' : BR.join(self.info.split(NL)),
+ '<mm-list-description>' : Utils.websafe(self.description),
+ '<mm-list-info>' :
+ '<!---->' + BR.join(self.info.split(NL)) + '<!---->',
'<mm-form-end>' : self.FormatFormEnd(),
'<mm-archive>' : self.FormatArchiveAnchor(),
'</mm-archive>' : '</a>',
=== modified file 'Mailman/Utils.py'
--- Mailman/Utils.py 2009-08-01 19:22:34 +0000
+++ Mailman/Utils.py 2010-09-09 15:16:57 +0000
@@ -1,4 +1,4 @@
-# Copyright (C) 1998-2009 by the Free Software Foundation, Inc.
+# Copyright (C) 1998-2010 by the Free Software Foundation, Inc.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
@@ -911,99 +911,100 @@
# Kludge to allow the specific tag that's in the options.html template.
'<link(?! rel="SHORTCUT ICON" href="<mm-favicon>">)',
'<meta',
+ '<object',
'<script',
- r'(?:^|\W)j(?:ava)?script(?:\W|$)',
- r'(?:^|\W)vbs(?:cript)?(?:\W|$)',
- r'(?:^|\W)domactivate(?:\W|$)',
- r'(?:^|\W)domattrmodified(?:\W|$)',
- r'(?:^|\W)domcharacterdatamodified(?:\W|$)',
- r'(?:^|\W)domfocus(?:in|out)(?:\W|$)',
- r'(?:^|\W)dommenuitem(?:in)?active(?:\W|$)',
- r'(?:^|\W)dommousescroll(?:\W|$)',
- r'(?:^|\W)domnodeinserted(?:intodocument)?(?:\W|$)',
- r'(?:^|\W)domnoderemoved(?:fromdocument)?(?:\W|$)',
- r'(?:^|\W)domsubtreemodified(?:\W|$)',
- r'(?:^|\W)fscommand(?:\W|$)',
- r'(?:^|\W)onabort(?:\W|$)',
- r'(?:^|\W)on(?:de)?activate(?:\W|$)',
- r'(?:^|\W)on(?:after|before)print(?:\W|$)',
- r'(?:^|\W)on(?:after|before)update(?:\W|$)',
- r'(?:^|\W)onbefore(?:(?:de)?activate|copy|cut|editfocus|paste)(?:\W|$)',
- r'(?:^|\W)onbeforeunload(?:\W|$)',
- r'(?:^|\W)onbegin(?:\W|$)',
- r'(?:^|\W)onblur(?:\W|$)',
- r'(?:^|\W)onbounce(?:\W|$)',
- r'(?:^|\W)onbroadcast(?:\W|$)',
- r'(?:^|\W)on(?:cell)?change(?:\W|$)',
- r'(?:^|\W)oncheckboxstatechange(?:\W|$)',
- r'(?:^|\W)on(?:dbl)?click(?:\W|$)',
- r'(?:^|\W)onclose(?:\W|$)',
- r'(?:^|\W)oncommand(?:update)?(?:\W|$)',
- r'(?:^|\W)oncomposition(?:end|start)(?:\W|$)',
- r'(?:^|\W)oncontextmenu(?:\W|$)',
- r'(?:^|\W)oncontrolselect(?:\W|$)',
- r'(?:^|\W)oncopy(?:\W|$)',
- r'(?:^|\W)oncut(?:\W|$)',
- r'(?:^|\W)ondataavailable(?:\W|$)',
- r'(?:^|\W)ondataset(?:changed|complete)(?:\W|$)',
- r'(?:^|\W)ondrag(?:drop|end|enter|exit|gesture|leave|over)?(?:\W|$)',
- r'(?:^|\W)ondragstart(?:\W|$)',
- r'(?:^|\W)ondrop(?:\W|$)',
- r'(?:^|\W)onend(?:\W|$)',
- r'(?:^|\W)onerror(?:update)?(?:\W|$)',
- r'(?:^|\W)onfilterchange(?:\W|$)',
- r'(?:^|\W)onfinish(?:\W|$)',
- r'(?:^|\W)onfocus(?:in|out)?(?:\W|$)',
- r'(?:^|\W)onhelp(?:\W|$)',
- r'(?:^|\W)oninput(?:\W|$)',
- r'(?:^|\W)onkey(?:up|down|press)(?:\W|$)',
- r'(?:^|\W)onlayoutcomplete(?:\W|$)',
- r'(?:^|\W)on(?:un)?load(?:\W|$)',
- r'(?:^|\W)onlosecapture(?:\W|$)',
- r'(?:^|\W)onmedia(?:complete|error)(?:\W|$)',
- r'(?:^|\W)onmouse(?:down|enter|leave|move|out|over|up|wheel)(?:\W|$)',
- r'(?:^|\W)onmove(?:end|start)?(?:\W|$)',
- r'(?:^|\W)on(?:off|on)line(?:\W|$)',
- r'(?:^|\W)onoutofsync(?:\W|$)',
- r'(?:^|\W)onoverflow(?:changed)?(?:\W|$)',
- r'(?:^|\W)onpage(?:hide|show)(?:\W|$)',
- r'(?:^|\W)onpaint(?:\W|$)',
- r'(?:^|\W)onpaste(?:\W|$)',
- r'(?:^|\W)onpause(?:\W|$)',
- r'(?:^|\W)onpopup(?:hidden|hiding|showing|shown)(?:\W|$)',
- r'(?:^|\W)onprogress(?:\W|$)',
- r'(?:^|\W)onpropertychange(?:\W|$)',
- r'(?:^|\W)onradiostatechange(?:\W|$)',
- r'(?:^|\W)onreadystatechange(?:\W|$)',
- r'(?:^|\W)onrepeat(?:\W|$)',
- r'(?:^|\W)onreset(?:\W|$)',
- r'(?:^|\W)onresize(?:end|start)?(?:\W|$)',
- r'(?:^|\W)onresume(?:\W|$)',
- r'(?:^|\W)onreverse(?:\W|$)',
- r'(?:^|\W)onrow(?:delete|enter|exit|inserted)(?:\W|$)',
- r'(?:^|\W)onrows(?:delete|enter|inserted)(?:\W|$)',
- r'(?:^|\W)onscroll(?:\W|$)',
- r'(?:^|\W)onseek(?:\W|$)',
- r'(?:^|\W)onselect(?:start)?(?:\W|$)',
- r'(?:^|\W)onselectionchange(?:\W|$)',
- r'(?:^|\W)onstart(?:\W|$)',
- r'(?:^|\W)onstop(?:\W|$)',
- r'(?:^|\W)onsubmit(?:\W|$)',
- r'(?:^|\W)onsync(?:from|to)preference(?:\W|$)',
- r'(?:^|\W)onsyncrestored(?:\W|$)',
- r'(?:^|\W)ontext(?:\W|$)',
- r'(?:^|\W)ontimeerror(?:\W|$)',
- r'(?:^|\W)ontrackchange(?:\W|$)',
- r'(?:^|\W)onunderflow(?:\W|$)',
- r'(?:^|\W)onurlflip(?:\W|$)',
- r'(?:^|\W)seeksegmenttime(?:\W|$)',
- r'(?:^|\W)svgabort(?:\W|$)',
- r'(?:^|\W)svgerror(?:\W|$)',
- r'(?:^|\W)svgload(?:\W|$)',
- r'(?:^|\W)svgresize(?:\W|$)',
- r'(?:^|\W)svgscroll(?:\W|$)',
- r'(?:^|\W)svgunload(?:\W|$)',
- r'(?:^|\W)svgzoom(?:\W|$)',
+ r'\bj(?:ava)?script\b',
+ r'\bvbs(?:cript)?\b',
+ r'\bdomactivate\b',
+ r'\bdomattrmodified\b',
+ r'\bdomcharacterdatamodified\b',
+ r'\bdomfocus(?:in|out)\b',
+ r'\bdommenuitem(?:in)?active\b',
+ r'\bdommousescroll\b',
+ r'\bdomnodeinserted(?:intodocument)?\b',
+ r'\bdomnoderemoved(?:fromdocument)?\b',
+ r'\bdomsubtreemodified\b',
+ r'\bfscommand\b',
+ r'\bonabort\b',
+ r'\bon(?:de)?activate\b',
+ r'\bon(?:after|before)print\b',
+ r'\bon(?:after|before)update\b',
+ r'\bonbefore(?:(?:de)?activate|copy|cut|editfocus|paste)\b',
+ r'\bonbeforeunload\b',
+ r'\bonbegin\b',
+ r'\bonblur\b',
+ r'\bonbounce\b',
+ r'\bonbroadcast\b',
+ r'\bon(?:cell)?change\b',
+ r'\boncheckboxstatechange\b',
+ r'\bon(?:dbl)?click\b',
+ r'\bonclose\b',
+ r'\boncommand(?:update)?\b',
+ r'\boncomposition(?:end|start)\b',
+ r'\boncontextmenu\b',
+ r'\boncontrolselect\b',
+ r'\boncopy\b',
+ r'\boncut\b',
+ r'\bondataavailable\b',
+ r'\bondataset(?:changed|complete)\b',
+ r'\bondrag(?:drop|end|enter|exit|gesture|leave|over)?\b',
+ r'\bondragstart\b',
+ r'\bondrop\b',
+ r'\bonend\b',
+ r'\bonerror(?:update)?\b',
+ r'\bonfilterchange\b',
+ r'\bonfinish\b',
+ r'\bonfocus(?:in|out)?\b',
+ r'\bonhelp\b',
+ r'\boninput\b',
+ r'\bonkey(?:up|down|press)\b',
+ r'\bonlayoutcomplete\b',
+ r'\bon(?:un)?load\b',
+ r'\bonlosecapture\b',
+ r'\bonmedia(?:complete|error)\b',
+ r'\bonmouse(?:down|enter|leave|move|out|over|up|wheel)\b',
+ r'\bonmove(?:end|start)?\b',
+ r'\bon(?:off|on)line\b',
+ r'\bonoutofsync\b',
+ r'\bonoverflow(?:changed)?\b',
+ r'\bonpage(?:hide|show)\b',
+ r'\bonpaint\b',
+ r'\bonpaste\b',
+ r'\bonpause\b',
+ r'\bonpopup(?:hidden|hiding|showing|shown)\b',
+ r'\bonprogress\b',
+ r'\bonpropertychange\b',
+ r'\bonradiostatechange\b',
+ r'\bonreadystatechange\b',
+ r'\bonrepeat\b',
+ r'\bonreset\b',
+ r'\bonresize(?:end|start)?\b',
+ r'\bonresume\b',
+ r'\bonreverse\b',
+ r'\bonrow(?:delete|enter|exit|inserted)\b',
+ r'\bonrows(?:delete|enter|inserted)\b',
+ r'\bonscroll\b',
+ r'\bonseek\b',
+ r'\bonselect(?:start)?\b',
+ r'\bonselectionchange\b',
+ r'\bonstart\b',
+ r'\bonstop\b',
+ r'\bonsubmit\b',
+ r'\bonsync(?:from|to)preference\b',
+ r'\bonsyncrestored\b',
+ r'\bontext\b',
+ r'\bontimeerror\b',
+ r'\bontrackchange\b',
+ r'\bonunderflow\b',
+ r'\bonurlflip\b',
+ r'\bseeksegmenttime\b',
+ r'\bsvgabort\b',
+ r'\bsvgerror\b',
+ r'\bsvgload\b',
+ r'\bsvgresize\b',
+ r'\bsvgscroll\b',
+ r'\bsvgunload\b',
+ r'\bsvgzoom\b',
]
=== modified file 'NEWS'
--- NEWS 2010-09-07 20:10:57 +0000
+++ NEWS 2010-09-09 15:16:57 +0000
@@ -6,6 +6,10 @@
2.1.14 (xx-xxx-xxxx)
+ Security
+
+ - Two potential XSS vulnerabilities have been identified and fixed.
+
New Features
- A new feature for controlling the addition/replacement of the Sender:
signature.asc
Description: Digital signature
