[UCI-Linux] [SECURITY] Fedora Core 3 Update: mailman-2.1.5-32.fc3

Mike Iglesias IGLESIAS at uci.edu
Tue Mar 22 19:47:31 PST 2005


From: John Dennis <jdennis at redhat.com>
To: fedora-announce <fedora-announce-list at redhat.com>
Date: Tue, 22 Mar 2005 15:56:15 -0500
Subject: [SECURITY] Fedora Core 3 Update: mailman-2.1.5-32.fc3

---------------------------------------------------------------------
Fedora Update Notification
FEDORA-2005-242
2005-03-22
---------------------------------------------------------------------

Product     : Fedora Core 3
Name        : mailman
Version     : 2.1.5                      
Release     : 32.fc3                  
Summary     : Mailing list manager with built in Web access.
Description :
Mailman is software to help manage email discussion lists, much like
Majordomo and Smartmail. Unlike most similar products, Mailman gives
each mailing list a webpage, and allows users to subscribe,
unsubscribe, etc. over the Web. Even the list manager can administer
his or her list entirely from the Web. Mailman also integrates most
things people want to do with mailing lists, including archiving, mail
<-> news gateways, and so on.

Documentation can be found in: /usr/share/doc/mailman-2.1.5

When the package has finished installing, you will need to perform some
additional installation steps, these are described in:
/usr/share/doc/mailman-2.1.5/INSTALL.REDHAT

---------------------------------------------------------------------
Update Information:

A cross-site scripting (XSS) flaw in the driver script of mailman
prior to version 2.1.5 could allow remote attackers to execute scripts
as other web users. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-1177 to this issue.

Users of mailman should update to this erratum package, which corrects
this issue by turning on STEALTH_MODE by default and using
Utils.websafe() to quote the html.

In addition this version of the rpm includes a utility script in 
/usr/share/doc/mailman-*/contrib/migrate-fhs that can be run if the
user has installed an FC3 or FC4 mailman rpm over an older non-FHS
compliant mailman installation. The script will aid in moving the file
locations from the old directory structure to the new FHS mailman
directory structure that are present in FC3, FC4, and RHEL4. Users who
have installed mailman originally from FC3, FC4 or RHEL4 will not need
to migration any file locations.

---------------------------------------------------------------------
* Wed Mar  2 2005 John Dennis <jdennis at redhat.com> - 3:2.1.5-32.fc3

- fix bug #150065, provide migration script for new FHS installation
- fix bug #147833, CAN-2004-1177

* Mon Feb 14 2005 John Dennis <jdennis at redhat.com> - 3:2.1.5-31.fc3

- fix bug #132750, add daemon to mail-gid so courier mail server will work.
- fix bug #143008, wrong location of mailmanctl in logrotate
- fix bug #142605, init script doesn't use /var/lock/subsys

* Tue Feb  8 2005 John Dennis <jdennis at redhat.com> - 3:2.1.5-30.fc3

- fix security vulnerability CAN-2005-0202, errata RHSA-2005:137, bug #147343

* Tue Nov  9 2004 John Dennis <jdennis at redhat.com> 3:2.1.5-29.fc3

- fix bug #137863, buildroot path in .pyc files

* Mon Nov  8 2004 John Dennis <jdennis at redhat.com> 3:2.1.5-27

- rebuild to fix bug #137863, python embeds build root in .pyc files

* Sat Oct 16 2004 John Dennis <jdennis at redhat.com> 3:2.1.5-26

- fix typo in install documentation
- fix error in templates/Makefile.in, bad install args, fixes bug #136001,
  thank you to Kaj J. Niemi for spotting this.

* Thu Oct 14 2004 John Dennis <jdennis at redhat.com> 3:2.1.5-24

- more FHS changes, matches with new SELinux security policy

* Wed Sep 29 2004 John Dennis <jdennis at redhat.com> 3:2.1.5-21

- move list data dir to /var/lib/mailman to conform to FHS
  move lock dir to /var/lock/mailman to conform to FHS
  move config dir (VAR_PREFIX/data) to /etc/mailman to conform to FHS
  Thanks to Matt Domsch for pointing this out.

* Tue Sep 28 2004 John Dennis <jdennis at redhat.com> 3:2.1.5-20

- fix bug #132732, security policy violations,
- bump release verison
  move non-data installation files from /var/mailman to /usr/lib/mailman,
  update documentation

* Fri Sep 10 2004 John Dennis <jdennis at redhat.com> 3:2.1.5-19

- add il18n start/stop strings to init.d script

* Fri Sep 10 2004 John Dennis <jdennis at redhat.com> 3:2.1.5-18

- fix bug #89250, add condrestart
  also fix status return values in mailmanctl and init.d script

* Tue Sep  7 2004 John Dennis <jdennis at redhat.com> 3:2.1.5-17

- fix bug #120930, add contents of contrib to doc area

* Tue Sep  7 2004 John Dennis <jdennis at redhat.com> 3:2.1.5-16

- fix bug #121220, httpd config file tweaks
  add doc to INSTALL.REDHAT for selecting MTA

* Fri Sep  3 2004 John Dennis <jdennis at redhat.com> 3:2.1.5-15

- fix bug #117615, don't overwrite user modified templates on install
  made template directory "config noreplace"

* Thu Sep  2 2004 John Dennis <jdennis at redhat.com> 3:2.1.5-14

- add comments into the crontab files so users know the /etc/cron.d
  file is volitile and will edit the right file.
  Also make the master crontab file "config noreplace" so edits are preserved.

* Wed Sep  1 2004 John Dennis <jdennis at redhat.com> 3:2.1.5-13

- fix bug #124208, enable mailman cron jobs from init.d rather than during installation

* Tue Aug 31 2004 John Dennis <jdennis at redhat.com> 3:2.1.5-12

- fix bug #129920, cron jobs execute under wrong SELinux policy

* Mon Aug 30 2004 John Dennis <jdennis at redhat.com> 3:2.1.5-11

- remove all editing of aliases file in %pre and %post, fixes #bug 125651

* Mon Aug  9 2004 John Dennis <jdennis at redhat.com> 3:2.1.5-10

- fix bug #129492 and bug #120912
  stop using crontab to setup mailman's cron jobs,
  instead install cron script in /etc/cron.d

* Mon Aug  9 2004 John Dennis <jdennis at redhat.com> 3:2.1.5-9

- apply patch to elminate "-1 LISTNAME moderator request(s) waiting" messages
  problem desciption here:
  http://www.python.org/cgi-bin/faqw-mm.py?req=show&file=faq03.038.htp

* Tue Jun 15 2004 Elliot Lee <sopwith at redhat.com>

- rebuilt

* Wed Jun  9 2004 John Dennis <jdennis at redhat.com> - 3:2.1.5-7

- bump rev for rebuild

* Wed Jun  9 2004 John Dennis <jdennis at redhat.com> - 3:2.1.5-6

- fix bug in pre scriplet, last command had been "service mailman stop"
  which should have been harmless if mailman was not installed except
  that it left the exit status from the script as non-zero and rpm
  aborted the install.

* Wed Jun  9 2004 John Dennis <jdennis at redhat.com> - 3:2.1.5-5

- add status reporting to init.d control script
  stop mailman during an installation
  restart mailman if it had been running prior to installation

* Mon Jun  7 2004 John Dennis <jdennis at redhat.com> - 3:2.1.5-4

- back python prereq down to 2.2, should be sufficient

* Thu May 20 2004 John Dennis <jdennis at redhat.com> 3:2.1.5-3

- make python prereq be at least 2.3

* Tue May 18 2004 Jeremy Katz <katzj at redhat.com> 3:2.1.5-2

- rebuild

* Mon May 17 2004 John Dennis <jdennis at redhat.com> 3:2.1.5-1

- bring up to latest 2.1.5 upstream release
  From Barry Warsaw: Mailman 2.1.5, a bug fix release that also
  contains new support for the Turkish language, and a few minor new
  features. Mailman 2.1.5 is a significant upgrade which should
  improve disk i/o performance, administrative overhead for discarding
  held spams, and the behavior of bouncing member disables.  This
  version also contains a fix for an exploit that could allow 3rd
  parties to retrieve member passwords.  It is thus highly recommended
  that all existing sitesupgrade to the latest version

* Tue May  4 2004 Warren Togami <wtogami at redhat.com> 3:2.1.4-4

- #105638 fix bytecompile and rpm -V
- postun /etc/postfix/aliases fix
- clean uninstall (no more empty dirs)
- #115378 RedirectMatch syntax fix

* Fri Feb 13 2004 Elliot Lee <sopwith at redhat.com>

- rebuilt

* Fri Jan  9 2004 John Dennis <jdennis at finch.boston.redhat.com> 3:2.1.4-1

- upgrade to new upstream release 2.1.4
- fixes bugs 106349,112851,105367,91463

* Wed Jun  4 2003 Elliot Lee <sopwith at redhat.com>

- rebuilt

* Wed May  7 2003 John Dennis <jdennis at finch.boston.redhat.com>

- bring up to next upstream release 2.1.2

* Sun May  4 2003 Florian La Roche <Florian.LaRoche at redhat.de>

- fix typo in post script: mmusr -> mmuser

* Thu Apr 24 2003 John Dennis <jdennis at finch.boston.redhat.com>

- fix bug 72004, 74483, 74484, 87856 - improper log rotation
- fix bug 88083 - mailman user/group needed to exist during build
- fix bug 88144 - wrong %file attributes on mm_cfg.py
- fix bug 89221 - mailman user not created on install
- fix bug 89250 - wrong pid file name in initscript

* Wed Mar  5 2003 Florian La Roche <Florian.LaRoche at redhat.de>

- change to /etc/rc.d/init.d as in all other rpms

* Thu Feb 20 2003 John Dennis <jdennis at finch.boston.redhat.com>

- change mailman login shell from /bin/false to /sbin/nologin

* Fri Feb 14 2003 John Dennis <jdennis at finch.boston.redhat.com>

- bring package up to 2.1.1 release, add /usr/share/doc files

* Sat Feb  1 2003 Florian La Roche <Florian.LaRoche at redhat.de>

- make the icon dir owned by root:root as in other rpms

* Fri Jan 31 2003 John Dennis <jdennis at finch.boston.redhat.com>

- various small tweaks to the spec file to make installation cleaner
- use /usr/bin/python when compiling, redirect compile output to /dev/null,
- don't run update in %post, let the user do it, remove the .pyc files in %postun,
- add setting of MAILHOST and URLHOST to localhost.localdomain, don't let
- configure set them to the build machine.

* Mon Jan 27 2003 John Dennis <jdennis at finch.boston.redhat.com>

- add the cross site scripting (xss) security patch to version 2.1

* Fri Jan 24 2003 John Dennis <jdennis at finch.boston.redhat.com>

- do not start mailman service in %post

* Wed Jan 22 2003 Tim Powers <timp at redhat.com>

- rebuilt

* Mon Jan 20 2003 John Dennis <jdennis at finch.boston.redhat.com>

- 1) remove config patch, mailmanctl was not the right file to install in init.d,
- it needed to be scripts/mailman
- 2) rename httpd-mailman.conf to mailman.conf, since the file now lives
- in httpd/conf.d directory the http prefix is redundant and inconsistent
- with the other file names in that directory.

* Tue Jan  7 2003 John Dennis <jdennis at finch.boston.redhat.com>

- Bring package up to date with current upstream source, 2.1
- Fix several install/packaging problems that were in upstream source
- Add multiple mail group functionality
- Fix syntax error in fblast.py
- Remove the forced setting of mail host and url host in mm_cfg.py

* Tue Nov 12 2002 Tim Powers <timp at redhat.com> 2.0.13-4

- remove files from $$RPM_BUILD_ROOT that we don't intent to ship

* Wed Aug 14 2002 Nalin Dahyabhai <nalin at redhat.com> 2.0.13-3

- set MAILHOST and WWWHOST in case the configure script can't figure out the
  local host name

* Fri Aug  2 2002 Nalin Dahyabhai <nalin at redhat.com> 2.0.13-2

- rebuild

* Fri Aug  2 2002 Nalin Dahyabhai <nalin at redhat.com> 2.0.13-1

- specify log files individually, per faq wizard
- update to 2.0.13

* Wed May 22 2002 Nalin Dahyabhai <nalin at redhat.com> 2.0.11-1

- update to 2.0.11

* Fri Apr  5 2002 Nalin Dahyabhai <nalin at redhat.com> 2.0.9-1

- include README.QMAIL in with the docs (#58887)
- include README.SENDMAIL and README.EXIM in with the docs
- use an included httpd.conf file instead of listing the configuration
  directives in the %description, which due to specspo magic might look
  wrong sometimes (part of #51324)
- interpolate the DEFAULT_HOST_NAME value in mm.cfg into both the DEFAULT_URL
  and MAILMAN_OWNER (#57987)
- move logs to /var/log/mailman, qfiles to /var/spool/mailman, rotate
  logs in the log directory (#48724)
- raise exceptions when someone tries to set the admin address for a list
  to that of the admin alias (#61468)

* Thu Apr  4 2002 Nalin Dahyabhai <nalin at redhat.com>

- fix a default permissions problem in /var/mailman/archives/private,
  reported by Johannes Erdfelt
- update to 2.0.9

* Tue Apr  2 2002 Nalin Dahyabhai <nalin at redhat.com>

- make the symlink in /etc/smrsh relative

* Tue Dec 11 2001 Nalin Dahyabhai <nalin at redhat.com> 2.0.8-1

- set FQDN and URL at build-time so that they won't be set to the host the
  RPM package is built on (#59177)

* Wed Nov 28 2001 Nalin Dahyabhai <nalin at redhat.com>

- update to 2.0.8

* Sat Nov 17 2001 Florian La Roche <Florian.LaRoche at redhat.de> 2.0.7-1

- update to 2.0.7

* Wed Jul 25 2001 Nalin Dahyabhai <nalin at redhat.com> 2.0.6-1

- update to 2.0.6

* Mon Jun 25 2001 Nalin Dahyabhai <nalin at redhat.com>

- code in default user/group names/IDs

* Wed May 30 2001 Nalin Dahyabhai <nalin at redhat.com>

- update to 2.0.5
- change the default hostname from localhost to localhost.localdomain in the
  default configuration
- chuck configuration file settings other than those dependent on the host name
  (the build system's host name is not a good default)  (#32337)

* Tue Mar 13 2001 Nalin Dahyabhai <nalin at redhat.com>

- update to 2.0.3

* Tue Mar  6 2001 Nalin Dahyabhai <nalin at redhat.com>

- update to 2.0.2

* Wed Feb 21 2001 Nalin Dahyabhai <nalin at redhat.com>

- patch from Barry Warsaw (via mailman-developers) to not die on
  broken Content-Type: headers

* Tue Jan  9 2001 Nalin Dahyabhai <nalin at redhat.com>

- update to 2.0.1

* Wed Dec  6 2000 Nalin Dahyabhai <nalin at redhat.com>

- update to 2.0 final release
- move the data to /var

* Fri Oct 20 2000 Nalin Dahyabhai <nalin at redhat.com>

- update to beta 6

* Thu Aug  3 2000 Nalin Dahyabhai <nalin at redhat.com>

- add note about adding FollowSymlinks so that archives work

* Wed Aug  2 2000 Nalin Dahyabhai <nalin at redhat.com>

- make the default owner root again so that root owns the docs
- update to 2.0beta5, which fixes a possible security vulnerability
- add smrsh symlink

* Mon Jul 24 2000 Prospector <prospector at redhat.com>

- rebuilt

* Wed Jul 19 2000 Nalin Dahyabhai <nalin at redhat.com>

- update to beta4
- change uid/gid to apache.apache to match apache (#13593)
- properly recompile byte-compiled versions of the scripts (#13619)
- change mailman alias from root to postmaster

* Sat Jul  1 2000 Nalin Dahyabhai <nalin at redhat.com>

- update to beta3
- drop bugs and arch patches (integrated into beta3)

* Tue Jun 27 2000 Nalin Dahyabhai <nalin at redhat.com>

- move web files to reside under /var/www
- move files from /usr/share to /usr/share
- integrate spot-fixes from mailman lists via gnome.org

* Mon Jun 19 2000 Nalin Dahyabhai <nalin at redhat.com>

- rebuild for Power Tools

* Tue May 23 2000 Nalin Dahyabhai <nalin at redhat.com>

- Update to 2.0beta2 to pick up security fixes.
- Change equires python to list >= 1.5.2

* Mon Nov  8 1999 Bernhard Rosenkranzer <bero at redhat.com>

- 1.1

* Tue Sep 14 1999 Preston Brown <pbrown at redhat.com>

- 1.0 final.

* Tue Jun 15 1999 Preston Brown <pbrown at redhat.com>

- security fix for cookies
- moved to /usr/share/mailman

* Fri May 28 1999 Preston Brown <pbrown at redhat.com>

- fix up default values.

* Fri May  7 1999 Preston Brown <pbrown at redhat.com>

- modifications to install scripts

* Thu May  6 1999 Preston Brown <pbrown at redhat.com>

- initial RPM for SWS 3.0


---------------------------------------------------------------------
This update can be downloaded from:
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/

2035fb6745f1e7450014d6fc93599fd6  SRPMS/mailman-2.1.5-32.fc3.src.rpm
bce1fd54e4b957e893fdcd36b9c65dad  x86_64/mailman-2.1.5-32.fc3.x86_64.rpm
89dcbb4182b5a49b3fe936232c0b397b  x86_64/debug/mailman-debuginfo-2.1.5-32.fc3.x86_64.rpm
660ab67c528290082041a69aebc3d437  i386/mailman-2.1.5-32.fc3.i386.rpm
b1e34a8085876f74c06922f291ccb5af  i386/debug/mailman-debuginfo-2.1.5-32.fc3.i386.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.  
---------------------------------------------------------------------


-- 
John Dennis <jdennis at redhat.com>

--
fedora-announce-list mailing list
fedora-announce-list at redhat.com
http://www.redhat.com/mailman/listinfo/fedora-announce-list


More information about the UCI-Linux mailing list