Test ID:	1.3.6.1.4.1.25623.1.0.853514
Category:	SuSE Local Security Checks
Title:	openSUSE: Security Advisory for Recommended (openSUSE-SU-2020:1707-1)
Summary:	The remote host is missing an update for the 'Recommended'; package(s) announced via the openSUSE-SU-2020:1707-1 advisory.
Description:	Summary: The remote host is missing an update for the 'Recommended' package(s) announced via the openSUSE-SU-2020:1707-1 advisory. Vulnerability Insight: This update for mailman to version 2.1.34 fixes the following issues: - The fix for lp#1859104 can result in ValueError being thrown on attempts to subscribe to a list. This is fixed and extended to apply REFUSE_SECOND_PENDING to unsubscription as well. (lp#1878458) - DMARC mitigation no longer misses if the domain name returned by DNS contains upper case. (lp#1881035) - A new WARN_MEMBER_OF_SUBSCRIBE setting can be set to No to prevent mailbombing of a member of a list with private rosters by repeated subscribe attempts. (lp#1883017) - Very long filenames for scrubbed attachments are now truncated. (lp#1884456) - A content injection vulnerability via the private login page has been fixed. CVE-2020-15011 (lp#1877379, bsc#1173369) - A content injection vulnerability via the options login page has been discovered and reported by Vishal Singh. CVE-2020-12108 (lp#1873722, bsc#1171363) - Bounce recognition for a non-compliant Yahoo format is added. - Archiving workaround for non-ascii in string.lowercase in some Python packages is added. - Thanks to Jim Popovitch, there is now a dmarc_moderation_addresses list setting that can be used to apply dmarc_moderation_action to mail From: addresses listed or matching listed regexps. This can be used to modify mail to addresses that don't accept external mail From: themselves. - There is a new MAX_LISTNAME_LENGTH setting. The fix for lp#1780874 obtains a list of the names of all the all the lists in the installation in order to determine the maximum length of a legitimate list name. It does this on every web access and on sites with a very large number of lists, this can have performance implications. See the description in Defaults.py for more information. - Thanks to Ralf Jung there is now the ability to add text based captchas (aka textchas) to the listinfo subscribe form. See the documentation for the new CAPTCHA setting in Defaults.py for how to enable this. Also note that if you have custom listinfo.html templates, you will have to add a tag to those templates to make this work. This feature can be used in combination with or instead of the Google reCAPTCHA feature added in 2.1.26. - Thanks to Ralf Hildebrandt the web admin Membership Management section now has a feature to sync the list's membership with a list of email addresses as with the bin/sync_members command. - There is a new drop_cc list attribute set from DEFAULT_DROP_CC. This controls the dropping of addresses from the Cc: header in delivered messages by the duplicate avoidance ... Description truncated. Please see the references for more information. Affected Software/OS: 'Recommended' package(s) on openSUSE Leap 15.2. Solution: Please install the updated package(s). CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2020-12108 Debian Security Information: DSA-4991 (Google Search) https://www.debian.org/security/2021/dsa-4991 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/74EQIVFB34Q4UYAQLCUWG55YLKAUWCHD/ https://code.launchpad.net/mailman https://mail.python.org/pipermail/mailman-announce/ https://lists.debian.org/debian-lts-announce/2020/05/msg00007.html https://lists.debian.org/debian-lts-announce/2020/07/msg00007.html SuSE Security Announcement: openSUSE-SU-2020:0661 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00036.html SuSE Security Announcement: openSUSE-SU-2020:0764 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00003.html SuSE Security Announcement: openSUSE-SU-2020:1707 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00047.html SuSE Security Announcement: openSUSE-SU-2020:1752 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00063.html https://usn.ubuntu.com/4354-1/ Common Vulnerability Exposure (CVE) ID: CVE-2020-12137 Debian Security Information: DSA-4664 (Google Search) https://www.debian.org/security/2020/dsa-4664 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6YCMGTTOXXCVM4O6CYZLTZDX6YLYORNF/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4COSBBEMJYLV7WSW5QTUJUOFJFK47KK/ http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/NEWS https://www.openwall.com/lists/oss-security/2020/02/24/2 https://www.openwall.com/lists/oss-security/2020/02/24/3 https://lists.debian.org/debian-lts-announce/2020/05/msg00002.html http://www.openwall.com/lists/oss-security/2020/04/24/3 https://usn.ubuntu.com/4348-1/ Common Vulnerability Exposure (CVE) ID: CVE-2020-15011 https://bugs.launchpad.net/mailman/+bug/1877379 https://lists.debian.org/debian-lts-announce/2020/06/msg00036.html https://usn.ubuntu.com/4406-1/
Copyright	Copyright (C) 2020 Greenbone Networks GmbH

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.