Security update for mailman SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:14068-1 Final 1 1 2019-05-31T06:11:00Z current 2019-05-31T06:11:00Z 2019-05-31T06:11:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for mailman This update for mailman fixes the following issues: Security issue fixed: - CVE-2016-6893: Fixed a Cross-site request forgery vulnerability in the admin web interface (bsc#997205). Following bug was fixed: - Allow CSRF check to pass in mailman web frontend if the list name contains a '+' (bsc#1102416) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleposp3-mailman-14068,slessp4-mailman-14068 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-201914068-1/ Link for SUSE-SU-2019:14068-1 https://lists.suse.com/pipermail/sle-security-updates/2019-May/005519.html E-Mail link for SUSE-SU-2019:14068-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1102416 SUSE Bug 1102416 https://bugzilla.suse.com/997205 SUSE Bug 997205 https://www.suse.com/security/cve/CVE-2016-6893/ SUSE CVE CVE-2016-6893 page SUSE Linux Enterprise Point of Sale 11 SP3 SUSE Linux Enterprise Server 11 SP4-LTSS mailman-2.1.15-9.6.12.1 mailman-2.1.15-9.6.12.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 mailman-2.1.15-9.6.12.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account. CVE-2016-6893 SUSE Linux Enterprise Point of Sale 11 SP3:mailman-2.1.15-9.6.12.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mailman-2.1.15-9.6.12.1 low 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914068-1/ https://www.suse.com/security/cve/CVE-2016-6893.html CVE-2016-6893 https://bugzilla.suse.com/995352 SUSE Bug 995352 https://bugzilla.suse.com/997205 SUSE Bug 997205