PyPI/postorius CVE-2021-40347: unknown, EPSS 1.19%
An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also
Action: Upgrade postorius to 1.3.5 or later.
pip install postorius==1.3.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.3.5 | - |
Fixed versions
| 1.3.5 |
Sources
- osv: PYSEC-2021-319
- https://gitlab.com/mailman/postorius/-/commit/3d880c56b58bc26b32eac0799407d74b64b7474b
- https://gitlab.com/mailman/postorius/-/tags
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993746
- https://gitlab.com/mailman/postorius/-/issues/531
- https://phabricator.wikimedia.org/T289798
- https://www.debian.org/security/2021/dsa-4970
- https://github.com/advisories/GHSA-v83x-78q3-gr2j
CVE-2021-40347 · published · modified · JSON