Your message dated Thu, 10 Feb 2005 06:47:31 -0500
with message-id <[EMAIL PROTECTED]>
and subject line Bug#294467: fixed in mailman 2.1.5-6
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 9 Feb 2005 20:46:10 +0000
>From [EMAIL PROTECTED] Wed Feb 09 12:46:10 2005
Return-path: <[EMAIL PROTECTED]>
Received: from mail.enyo.de [212.9.189.167]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1Cyyiw-0008WO-00; Wed, 09 Feb 2005 12:46:10 -0800
Received: from deneb.enyo.de ([212.9.189.171])
by albireo.enyo.de with esmtp id 1Cyyiv-0004dX-54
for [EMAIL PROTECTED]; Wed, 09 Feb 2005 21:46:09 +0100
Received: from fw by deneb.enyo.de with local (Exim 4.43)
id 1Cyyit-0002DF-3o; Wed, 09 Feb 2005 21:46:07 +0100
Content-Type: multipart/mixed; boundary="===============1997112492=="
MIME-Version: 1.0
From: Florian Weimer <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: mailman: (CAN-2005-0202) directory traversal vulnerability
X-Mailer: reportbug 3.5
Date: Wed, 09 Feb 2005 21:46:07 +0100
Message-Id: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
This is a multi-part MIME message sent by reportbug.
--===============1997112492==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Package: mailman
Version: 2.1.5-5
Severity: grave
Tags: security
Justification: user security hole
See:
<http://lists.netsys.com/pipermail/full-disclosure/2005-February/031562.html>
The attached patch fixes this hole. The list expression works on Python
2.1.3.
--===============1997112492==
Content-Type: application/x-shellscript
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="40_can-2005-0202.dpatch"
IyEgL2Jpbi9zaCAvdXNyL3NoYXJlL2RwYXRjaC9kcGF0Y2gtcnVuCiMjIDQwX2Nhbi0yMDA1LTAy
MDIuZHBhdGNoIGJ5ICA8ZndAZGVuZWIuZW55by5kZT4KIyMKIyMgQWxsIGxpbmVzIGJlZ2lubmlu
ZyB3aXRoIGAjIyBEUDonIGFyZSBhIGRlc2NyaXB0aW9uIG9mIHRoZSBwYXRjaC4KIyMgRFA6IEZp
eCBkaXJlY3RvcnkgdHJhdmVyc2FsIHNlY3VyaXR5IGJ1ZyBDQU4tMjAwNS0wMjAyLgoKQERQQVRD
SEAKZGlmZiAtdXJOYWQgbWFpbG1hbi0yLjEuNS9NYWlsbWFuL0NnaS9wcml2YXRlLnB5IC90bXAv
ZHBlcC4xczMzRmUvbWFpbG1hbi0yLjEuNS9NYWlsbWFuL0NnaS9wcml2YXRlLnB5Ci0tLSBtYWls
bWFuLTIuMS41L01haWxtYW4vQ2dpL3ByaXZhdGUucHkJMjAwMy0wMi0wOCAwODoxMzo1MC4wMDAw
MDAwMDAgKzAxMDAKKysrIC90bXAvZHBlcC4xczMzRmUvbWFpbG1hbi0yLjEuNS9NYWlsbWFuL0Nn
aS9wcml2YXRlLnB5CTIwMDUtMDItMDkgMjE6MDA6MzYuMDAwMDAwMDAwICswMTAwCkBAIC0zNywx
MSArMzcsMTIgQEAKIAogCiAMCitTTEFTSCA9ICcvJworCiBkZWYgdHJ1ZV9wYXRoKHBhdGgpOgog
ICAgICJFbnN1cmUgdGhhdCB0aGUgcGF0aCBpcyBzYWZlIGJ5IHJlbW92aW5nIC4uIgotICAgIHBh
dGggPSBwYXRoLnJlcGxhY2UoJy4uLycsICcnKQotICAgIHBhdGggPSBwYXRoLnJlcGxhY2UoJy4v
JywgJycpCi0gICAgcmV0dXJuIHBhdGhbMTpdCisgICAgcGFydHMgPSBbeCBmb3IgeCBpbiBwYXRo
LnNwbGl0KFNMQVNIKSBpZiB4IG5vdCBpbiAoJy4nLCAnLi4nKV0KKyAgICByZXR1cm4gU0xBU0gu
am9pbihwYXJ0cylbMTpdCiAKIAogDAo=
--===============1997112492==--
---------------------------------------
Received: (at 294467-close) by bugs.debian.org; 10 Feb 2005 11:53:02 +0000
>From [EMAIL PROTECTED] Thu Feb 10 03:53:02 2005
Return-path: <[EMAIL PROTECTED]>
Received: from newraff.debian.org [208.185.25.31] (mail)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1CzCsY-0006iI-00; Thu, 10 Feb 2005 03:53:02 -0800
Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian))
id 1CzCnD-0007US-00; Thu, 10 Feb 2005 06:47:31 -0500
From: Tollef Fog Heen <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.55 $
Subject: Bug#294467: fixed in mailman 2.1.5-6
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Thu, 10 Feb 2005 06:47:31 -0500
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
X-CrossAssassin-Score: 4
Source: mailman
Source-Version: 2.1.5-6
We believe that the bug you reported is fixed in the latest version of
mailman, which is due to be installed in the Debian FTP archive:
mailman_2.1.5-6.diff.gz
to pool/main/m/mailman/mailman_2.1.5-6.diff.gz
mailman_2.1.5-6.dsc
to pool/main/m/mailman/mailman_2.1.5-6.dsc
mailman_2.1.5-6_i386.deb
to pool/main/m/mailman/mailman_2.1.5-6_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Tollef Fog Heen <[EMAIL PROTECTED]> (supplier of updated mailman package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Thu, 10 Feb 2005 12:10:42 +0100
Source: mailman
Binary: mailman
Architecture: source i386
Version: 2.1.5-6
Distribution: unstable
Urgency: high
Maintainer: Tollef Fog Heen <[EMAIL PROTECTED]>
Changed-By: Tollef Fog Heen <[EMAIL PROTECTED]>
Description:
mailman - Powerful, web-based mailing list manager
Closes: 283973 291289 293002 294467
Changes:
mailman (2.1.5-6) unstable; urgency=high
.
* SECURITY UPDATE: fix information disclosure
* Added debian/patches/04_CAN-2005-0202.dpatch:
Mailman/Cgi/private.py, true_path(): fix the removal of '..' and '.' from
private mail archive paths to prohibit path traversal (the former version
transformed ".....///" to "../") (closes: #294467)
(References: CAN-2005-0202)
* Tighten build-deps on dpatch. (closes: #291289)
* Update Czech debconf translation. (closes: #293002)
* Add Dutch debconf translation. (closes: #283973)
Files:
91fdedde9ada517bc94e52a29d8fa56a 651 mail optional mailman_2.1.5-6.dsc
bf85a3cb885618a9964a873fb769225e 182465 mail optional mailman_2.1.5-6.diff.gz
f30d18591db657a0c2870e54326a566c 6609034 mail optional mailman_2.1.5-6_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
iD8DBQFCC0YhQSseMYF6mWoRAn0FAJ91wD2djTv3KfETu6Cc3o/+WwjsKwCfX5jM
mkzVv05og/sDBHWI4mLFd50=
=+ZBW
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
