{
  "schema_version": "1.7.0",
  "id": "MGASA-2020-0276",
  "published": "2020-07-05T08:46:44Z",
  "modified": "2020-07-05T08:14:02Z",
  "summary": "Updated mailman packages fix security vulnerability",
  "details": "Updated mailman package fixes security vulnerability:\n\nUp to mailman 2.1.29 when sending a file without a file extension (or an\nunknown file extension) then the file is stored in the list archive with\nthe file extension .obj. Most web servers will try to assign a mime type\nbased on the file extension and entries in /etc/mime.types, where .obj is\nusually not specified. This means the web server will send it out without\na mime type. \nThe browser will then try to guess the MIME type based on the file's\ncontent (MIME-sniffing). If the content is HTML then it will execute any\njavascript contained, leading to a potential cross-site scripting\nvulnerability.\n\nThe mailman package has been updated to version 2.1.30, fixing this bug\nand other issues.  See the release announcement for details.\n",
  "upstream": [
    "CVE-2020-12137",
    "CVE-2020-12108",
    "CVE-2020-15011"
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://advisories.mageia.org/MGASA-2020-0276.html"
    },
    {
      "type": "REPORT",
      "url": "https://bugs.mageia.org/show_bug.cgi?id=26253"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2020/02/24/2"
    },
    {
      "type": "WEB",
      "url": "https://mail.python.org/pipermail/mailman-announce/2020-April/000250.html"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Mageia:7",
        "name": "mailman",
        "purl": "pkg:rpm/mageia/mailman?arch=source&distro=mageia-7"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.33-1.mga7"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "core"
      }
    }
  ],
  "credits": [
    {
      "name": "Mageia",
      "type": "COORDINATOR",
      "contact": [
        "https://wiki.mageia.org/en/Packages_Security_Team"
      ]
    }
  ]
}