From owner-freebsd-ports-bugs@FreeBSD.ORG Mon Mar 7 17:20:09 2011 Return-Path: Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 82B501065670 for ; Mon, 7 Mar 2011 17:20:09 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 46AA48FC19 for ; Mon, 7 Mar 2011 17:20:09 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id p27HK9oL055447 for ; Mon, 7 Mar 2011 17:20:09 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.4/8.14.4/Submit) id p27HK9LH055446; Mon, 7 Mar 2011 17:20:09 GMT (envelope-from gnats) Resent-Date: Mon, 7 Mar 2011 17:20:09 GMT Resent-Message-Id: <201103071720.p27HK9LH055446@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Hilko Meyer Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 86939106564A for ; Mon, 7 Mar 2011 17:15:09 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from red.freebsd.org (red.freebsd.org [IPv6:2001:4f8:fff6::22]) by mx1.freebsd.org (Postfix) with ESMTP id 5CFA08FC0C for ; Mon, 7 Mar 2011 17:15:09 +0000 (UTC) Received: from red.freebsd.org (localhost [127.0.0.1]) by red.freebsd.org (8.14.4/8.14.4) with ESMTP id p27HF9HB044967 for ; Mon, 7 Mar 2011 17:15:09 GMT (envelope-from nobody@red.freebsd.org) Received: (from nobody@localhost) by red.freebsd.org (8.14.4/8.14.4/Submit) id p27HF95Y044966; Mon, 7 Mar 2011 17:15:09 GMT (envelope-from nobody) Message-Id: <201103071715.p27HF95Y044966@red.freebsd.org> Date: Mon, 7 Mar 2011 17:15:09 GMT From: Hilko Meyer To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: ports/155355: XXS vulnerability affecting Mailman 2.1.14 and prior X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Mar 2011 17:20:09 -0000 >Number: 155355 >Category: ports >Synopsis: XXS vulnerability affecting Mailman 2.1.14 and prior >Confidential: no >Severity: serious >Priority: low >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Mar 07 17:20:08 UTC 2011 >Closed-Date: >Last-Modified: >Originator: Hilko Meyer >Release: >Organization: >Environment: >Description: Quoting http://mail.python.org/pipermail/mailman-developers/2011-February/021318.html On 2/13/2011 1:58 PM, Mark Sapiro wrote: > An XXS vulnerability affecting Mailman 2.1.14 and prior versions has > recently been discovered. A patch has been developed to address this > issue. The patch is small, affects only one module and can be applied to > a live installation without requiring a restart. > > In order to accommodate those who need some notice before applying such > a patch, the patch will be posted on Friday, 18 February at about 16:00 > GMT to the same four lists to which this announcement is addressed. The vulnerability has been assigned CVE-2011-0707. The patch is attached as confirm_xss.patch.txt. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0707 >How-To-Repeat: >Fix: Patch is in: http://mail.python.org/pipermail/mailman-developers/attachments/20110218/15500b22/attachment.txt Patch attached with submission follows: === modified file 'Mailman/Cgi/confirm.py' --- Mailman/Cgi/confirm.py 2010-03-29 20:48:11 +0000 +++ Mailman/Cgi/confirm.py 2011-02-12 02:24:47 +0000 @@ -471,7 +471,7 @@ if fullname is None: fullname = _('Not available') else: - fullname = Utils.uncanonstr(fullname, lang) + fullname = Utils.websafe(Utils.uncanonstr(fullname, lang)) table.AddRow([_("""Your confirmation is required in order to complete the unsubscription request from the mailing list %(listname)s. You are currently subscribed with @@ -573,7 +573,7 @@ if fullname is None: fullname = _('Not available') else: - fullname = Utils.uncanonstr(fullname, lang) + fullname = Utils.websafe(Utils.uncanonstr(fullname, lang)) if globally: globallys = _('globally') else: @@ -814,7 +814,7 @@ if username is None: username = _('not available') else: - username = Utils.uncanonstr(username, lang) + username = Utils.websafe(Utils.uncanonstr(username, lang)) table.AddRow([_("""Your membership in the %(realname)s mailing list is currently disabled due to excessive bounces. Your confirmation is >Release-Note: >Audit-Trail: >Unformatted: