Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 545070 (CVE-2015-2775)

Summary: <net-mail/mailman-2.1.20: Path traversal vulnerability (CVE-2015-2775)
Product: Gentoo Security Reporter: Agostino Sarubbo <ago>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: normal CC: hanno, net-mail+disabled
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: B4 [noglsa]
Package list:
Runtime testing required: ---

Description Agostino Sarubbo gentoo-dev 2015-03-30 15:23:24 UTC
From ${URL} :

A security vulnerability in Mailman has been found and fixed. It has
been assigned CVE-2015-2775. The details of this vulnerability and fix
will be announced next Tuesday, 31 March 2015, at which time both a
patch for this specific vulnerability and Mailman 2.1.20 will be released.

In addition to this security fix, Mailman 2.1.20 includes a new feature
allowing a list owner to change a list member's address through the
admin Membership Management... Section, and a couple of minor bug fixes.

The new feature is a fix for <>.

The bugs fixed are: <>,
<> and

The security vulnerability, the details of which are currently private,
is <>.

The security vulnerability only affects those installations which use
Exim, Postfix's or similar programmatic (not
aliases) MTA delivery to Mailman, and have untrusted local users on the
Mailman server.

@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Hanno Böck gentoo-dev 2015-03-31 22:49:08 UTC
Bumped, please stabilize mailman-2.1.20, target keywords:
KEYWORDS="amd64 ppc x86"

This is upstream's description of the vuln:
    - A path traversal vulnerability has been discovered and fixed.  This
      vulnerability is only exploitable by a local user on a Mailman server
      where the suggested Exim transport, the Postfix
      transport or some other programmatic MTA delivery not using aliases
      is employed.  CVE-2015-2775  (LP: #1437145)
Comment 2 Agostino Sarubbo gentoo-dev 2015-04-01 07:53:51 UTC
Stable for amd64/ppc/x86
Comment 3 Yury German Gentoo Infrastructure gentoo-dev 2015-04-05 05:40:18 UTC
Arches, Thank you for your work.

Maintainer(s), please drop the vulnerable version(s).

GLSA Vote: No
Comment 4 GLSAMaker/CVETool Bot gentoo-dev 2015-04-22 18:44:38 UTC
CVE-2015-2775 (
  Directory traversal vulnerability in GNU Mailman before 2.1.20, when not
  using a static alias, allows remote attackers to execute arbitrary files via
  a .. (dot dot) in a list name.
Comment 5 Yury German Gentoo Infrastructure gentoo-dev 2015-05-11 15:34:49 UTC
It has been 30 days+ since cleanup requested.
Maintainer(s), please drop the vulnerable version(s).
Comment 6 Kristian Fiskerstrand (RETIRED) gentoo-dev 2015-05-11 15:58:19 UTC
GLSA Vote: No
Comment 7 Hanno Böck gentoo-dev 2015-05-11 16:02:38 UTC
cleanup done.
Comment 8 Yury German Gentoo Infrastructure gentoo-dev 2015-05-11 16:03:43 UTC
Maintainer(s), Thank you for you for cleanup.