CVE-2020-12137
Summary
| CVE | CVE-2020-12137 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-04-24 13:15:00 UTC |
|---|
| Updated | 2023-11-07 03:15:00 UTC |
|---|
| Description | GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] [DLA 2200-1] mailman security update |
MLIST |
lists.debian.org |
|
| [security-announce] openSUSE-SU-2020:1752-1: moderate: Recommended updat |
SUSE |
lists.opensuse.org |
|
| [SECURITY] Fedora 32 Update: mailman-2.1.32-2.fc32 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| Debian -- Security Information -- DSA-4664-1 mailman |
DEBIAN |
www.debian.org |
Third Party Advisory |
| [SECURITY] Fedora 32 Update: mailman-2.1.32-2.fc32 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] Fedora 31 Update: mailman-2.1.30-1.fc31 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| USN-4348-1: Mailman vulnerabilities | Ubuntu security notices |
UBUNTU |
usn.ubuntu.com |
|
| oss-security - Re: mailman 2.x: XSS via file attachments in list
archives |
MISC |
www.openwall.com |
Mailing List, Third Party Advisory |
| ~mailman-coders/mailman/2.1 : contents of NEWS at revision 1806 |
MISC |
bazaar.launchpad.net |
Third Party Advisory |
| oss-security - Re: mailman 2.x: XSS via file attachments in list
archives |
MLIST |
www.openwall.com |
Mailing List, Third Party Advisory |
| [SECURITY] Fedora 31 Update: mailman-2.1.30-1.fc31 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| oss-security - mailman 2.x: XSS via file attachments in list archives |
MISC |
www.openwall.com |
Mailing List, Third Party Advisory |
| [security-announce] openSUSE-SU-2020:1707-1: moderate: Recommended updat |
SUSE |
lists.opensuse.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 177809 Debian Security Update for mailman (DLA 2200-1)
- 198576 Ubuntu Security Notification for Mailman Vulnerabilities (USN-5121-2)
- 377570 Alibaba Cloud Linux Security Update for mailman:2.1 (ALINUX3-SA-2022:0093)
- 940004 AlmaLinux Security Update for mailman:2.1 (ALSA-2020:4667)
