Spoofing attack in Mailman - CVE-2020-12108

Vulnerability identifier: #VU28635

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12108

CWE-ID: CWE-451

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data when processing email addresses. A remote attacker can create a specially crafted email and spoof content of email message.

Mailman
Debian Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Oracle Solaris
SUSE Linux
Opensuse
openEuler
Ubuntu
Fedora
mailman (Debian package)
mailman (Ubuntu package)
mailman
mailman-debugsource
mailman-debuginfo

Install updates from vendor's website.

Mailman - update to 2.1.31
mailman (Debian package) - update to 1:2.1.29-1+deb10u2
mailman (Ubuntu package) - update to 1:2.1.29-1ubuntu3.1
mailman - update to 2.1.29-8
mailman-debugsource - update to 2.1.29-8
mailman-debuginfo - update to 2.1.29-8
mailman - update to 2.1.34-1.fc31

• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00036.html
• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00003.html
• https://bugs.launchpad.net/mailman/+bug/1873722
• https://code.launchpad.net/mailman
• https://lists.debian.org/debian-lts-announce/2020/05/msg00007.html
• https://mail.python.org/pipermail/mailman-announce/
• https://usn.ubuntu.com/4354-1/

• Spoofing attack in GNU Mailman
• OpenSUSE Linux update for mailman
• OpenSUSE Linux update for mailman
• Oracle Solaris security update for third party software (July 2020)
• Red Hat Enterprise Linux 8 update for the mailman:2.1 module
• Ubuntu update for mailman
• Debian update for mailman
• openEuler update for mailman
• Fedora 31 update for mailman