Mageia alert MGASA-2016-0343 (mailman)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2016-0343: Updated mailman package fixes security vulnerability 
Date:
    	     
 
Tue, 18 Oct 2016 20:44:11 +0200
Message-ID:
    	     
 
<20161018184411.25F8E9F79E@duvel.mageia.org>
MGASA-2016-0343 - Updated mailman package fixes security vulnerability

Publication date: 18 Oct 2016
URL: http://advisories.mageia.org/MGASA-2016-0343.html
Type: security
Affected Mageia releases: 5
CVE: CVE-2016-6893

Description:
Cross-site request forgery (CSRF) vulnerability in the user options page in 
GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the 
authentication of arbitrary users for requests that modify an option, as 
demonstrated by gaining access to the credentials of a victim's account 
(CVE-2016-6893).

References:
- https://bugs.mageia.org/show_bug.cgi?id=19287
- https://www.debian.org/security/2016/dsa-3668
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6893

SRPMS:
- 5/core/mailman-2.1.20-3.mga5