[Pkg-mailman-hackers] Pkg-mailman commit - rev 679 - in branches/lenny/debian: . patches

Thijs Kinkhorst thijs at alioth.debian.org
Wed Feb 16 19:34:37 UTC 2011


Author: thijs
Date: 2011-02-16 19:34:34 +0000 (Wed, 16 Feb 2011)
New Revision: 679

Added:
   branches/lenny/debian/patches/83-CVE-2010-3089--bug599833.patch
Modified:
   branches/lenny/debian/changelog
   branches/lenny/debian/patches/series
Log:
* Upload to lenny-security.
* CVE-2010-3089: cross-site scripting (XSS) vulnerabilities
  which can be exploited by list administrators (Closes: 599833).

Modified: branches/lenny/debian/changelog
===================================================================
--- branches/lenny/debian/changelog	2011-02-16 19:11:49 UTC (rev 678)
+++ branches/lenny/debian/changelog	2011-02-16 19:34:34 UTC (rev 679)
@@ -1,3 +1,11 @@
+mailman (1:2.1.11-11+lenny2) stable-security; urgency=high
+
+  * Upload to lenny-security.
+  * CVE-2010-3089: cross-site scripting (XSS) vulnerabilities
+    which can be exploited by list administrators (Closes: 599833).
+
+ -- Thijs Kinkhorst <thijs at debian.org>  Wed, 16 Feb 2011 20:17:19 +0100
+
 mailman (1:2.1.11-11+lenny1) stable-proposed-updates; urgency=low
 
   * Disable 32_MIME_fixup.patch. This has meanwhile been addressed

Added: branches/lenny/debian/patches/83-CVE-2010-3089--bug599833.patch
===================================================================
--- branches/lenny/debian/patches/83-CVE-2010-3089--bug599833.patch	                        (rev 0)
+++ branches/lenny/debian/patches/83-CVE-2010-3089--bug599833.patch	2011-02-16 19:34:34 UTC (rev 679)
@@ -0,0 +1,244 @@
+From a745670e2c3325fa49b222a533c4ed4bf3f4368e Mon Sep 17 00:00:00 2001
+From: Jari Aalto <jari.aalto at cante.net>
+Date: Fri, 15 Oct 2010 12:23:47 +0300
+Subject: [PATCH] CVE-2010-3089 Fixes from mailman 2.14 by <d+deb at vdr.jp>
+Organization: Private
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Jari Aalto <jari.aalto at cante.net>
+---
+ Mailman/Cgi/listinfo.py  |    4 +-
+ Mailman/HTMLFormatter.py |    7 +-
+ Mailman/Utils.py         |  187 +++++++++++++++++++++++-----------------------
+ 3 files changed, 100 insertions(+), 98 deletions(-)
+
+diff --git a/Mailman/Cgi/listinfo.py b/Mailman/Cgi/listinfo.py
+index 5b96590..4a54517 100644
+--- a/Mailman/Cgi/listinfo.py
++++ b/Mailman/Cgi/listinfo.py
+@@ -94,7 +94,7 @@ def listinfo_overview(msg=''):
+             else:
+                 advertised.append((mlist.GetScriptURL('listinfo'),
+                                    mlist.real_name,
+-                                   mlist.description))
++                                   Utils.websafe(mlist.description)))
+     if msg:
+         greeting = FontAttr(msg, color="ff5060", size="+1")
+     else:
+diff --git a/Mailman/HTMLFormatter.py b/Mailman/HTMLFormatter.py
+index 3a21d96..dad51e7 100644
+--- a/Mailman/HTMLFormatter.py
++++ b/Mailman/HTMLFormatter.py
+@@ -383,8 +383,9 @@ class HTMLFormatter:
+             '<mm-mailman-footer>' : self.GetMailmanFooter(),
+             '<mm-list-name>' : self.real_name,
+             '<mm-email-user>' : self._internal_name,
+-            '<mm-list-description>' : self.description,
+-            '<mm-list-info>' : BR.join(self.info.split(NL)),
++            '<mm-list-description>' : Utils.websafe(self.description),
++            '<mm-list-info>' : 
++                '<!---->' + BR.join(self.info.split(NL)) + '<!---->',
+             '<mm-form-end>'  : self.FormatFormEnd(),
+             '<mm-archive>'   : self.FormatArchiveAnchor(),
+             '</mm-archive>'  : '</a>',
+diff --git a/Mailman/Utils.py b/Mailman/Utils.py
+index 5cba077..d5babc1 100644
+--- a/Mailman/Utils.py
++++ b/Mailman/Utils.py
+@@ -911,99 +911,100 @@ _badwords = [
+     # Kludge to allow the specific tag that's in the options.html template.
+     '<link(?! rel="SHORTCUT ICON" href="<mm-favicon>">)',
+     '<meta',
++    '<object',
+     '<script',
+-    r'(?:^|\W)j(?:ava)?script(?:\W|$)',
+-    r'(?:^|\W)vbs(?:cript)?(?:\W|$)',
+-    r'(?:^|\W)domactivate(?:\W|$)',
+-    r'(?:^|\W)domattrmodified(?:\W|$)',
+-    r'(?:^|\W)domcharacterdatamodified(?:\W|$)',
+-    r'(?:^|\W)domfocus(?:in|out)(?:\W|$)',
+-    r'(?:^|\W)dommenuitem(?:in)?active(?:\W|$)',
+-    r'(?:^|\W)dommousescroll(?:\W|$)',
+-    r'(?:^|\W)domnodeinserted(?:intodocument)?(?:\W|$)',
+-    r'(?:^|\W)domnoderemoved(?:fromdocument)?(?:\W|$)',
+-    r'(?:^|\W)domsubtreemodified(?:\W|$)',
+-    r'(?:^|\W)fscommand(?:\W|$)',
+-    r'(?:^|\W)onabort(?:\W|$)',
+-    r'(?:^|\W)on(?:de)?activate(?:\W|$)',
+-    r'(?:^|\W)on(?:after|before)print(?:\W|$)',
+-    r'(?:^|\W)on(?:after|before)update(?:\W|$)',
+-    r'(?:^|\W)onbefore(?:(?:de)?activate|copy|cut|editfocus|paste)(?:\W|$)',
+-    r'(?:^|\W)onbeforeunload(?:\W|$)',
+-    r'(?:^|\W)onbegin(?:\W|$)',
+-    r'(?:^|\W)onblur(?:\W|$)',
+-    r'(?:^|\W)onbounce(?:\W|$)',
+-    r'(?:^|\W)onbroadcast(?:\W|$)',
+-    r'(?:^|\W)on(?:cell)?change(?:\W|$)',
+-    r'(?:^|\W)oncheckboxstatechange(?:\W|$)',
+-    r'(?:^|\W)on(?:dbl)?click(?:\W|$)',
+-    r'(?:^|\W)onclose(?:\W|$)',
+-    r'(?:^|\W)oncommand(?:update)?(?:\W|$)',
+-    r'(?:^|\W)oncomposition(?:end|start)(?:\W|$)',
+-    r'(?:^|\W)oncontextmenu(?:\W|$)',
+-    r'(?:^|\W)oncontrolselect(?:\W|$)',
+-    r'(?:^|\W)oncopy(?:\W|$)',
+-    r'(?:^|\W)oncut(?:\W|$)',
+-    r'(?:^|\W)ondataavailable(?:\W|$)',
+-    r'(?:^|\W)ondataset(?:changed|complete)(?:\W|$)',
+-    r'(?:^|\W)ondrag(?:drop|end|enter|exit|gesture|leave|over)?(?:\W|$)',
+-    r'(?:^|\W)ondragstart(?:\W|$)',
+-    r'(?:^|\W)ondrop(?:\W|$)',
+-    r'(?:^|\W)onend(?:\W|$)',
+-    r'(?:^|\W)onerror(?:update)?(?:\W|$)',
+-    r'(?:^|\W)onfilterchange(?:\W|$)',
+-    r'(?:^|\W)onfinish(?:\W|$)',
+-    r'(?:^|\W)onfocus(?:in|out)?(?:\W|$)',
+-    r'(?:^|\W)onhelp(?:\W|$)',
+-    r'(?:^|\W)oninput(?:\W|$)',
+-    r'(?:^|\W)onkey(?:up|down|press)(?:\W|$)',
+-    r'(?:^|\W)onlayoutcomplete(?:\W|$)',
+-    r'(?:^|\W)on(?:un)?load(?:\W|$)',
+-    r'(?:^|\W)onlosecapture(?:\W|$)',
+-    r'(?:^|\W)onmedia(?:complete|error)(?:\W|$)',
+-    r'(?:^|\W)onmouse(?:down|enter|leave|move|out|over|up|wheel)(?:\W|$)',
+-    r'(?:^|\W)onmove(?:end|start)?(?:\W|$)',
+-    r'(?:^|\W)on(?:off|on)line(?:\W|$)',
+-    r'(?:^|\W)onoutofsync(?:\W|$)',
+-    r'(?:^|\W)onoverflow(?:changed)?(?:\W|$)',
+-    r'(?:^|\W)onpage(?:hide|show)(?:\W|$)',
+-    r'(?:^|\W)onpaint(?:\W|$)',
+-    r'(?:^|\W)onpaste(?:\W|$)',
+-    r'(?:^|\W)onpause(?:\W|$)',
+-    r'(?:^|\W)onpopup(?:hidden|hiding|showing|shown)(?:\W|$)',
+-    r'(?:^|\W)onprogress(?:\W|$)',
+-    r'(?:^|\W)onpropertychange(?:\W|$)',
+-    r'(?:^|\W)onradiostatechange(?:\W|$)',
+-    r'(?:^|\W)onreadystatechange(?:\W|$)',
+-    r'(?:^|\W)onrepeat(?:\W|$)',
+-    r'(?:^|\W)onreset(?:\W|$)',
+-    r'(?:^|\W)onresize(?:end|start)?(?:\W|$)',
+-    r'(?:^|\W)onresume(?:\W|$)',
+-    r'(?:^|\W)onreverse(?:\W|$)',
+-    r'(?:^|\W)onrow(?:delete|enter|exit|inserted)(?:\W|$)',
+-    r'(?:^|\W)onrows(?:delete|enter|inserted)(?:\W|$)',
+-    r'(?:^|\W)onscroll(?:\W|$)',
+-    r'(?:^|\W)onseek(?:\W|$)',
+-    r'(?:^|\W)onselect(?:start)?(?:\W|$)',
+-    r'(?:^|\W)onselectionchange(?:\W|$)',
+-    r'(?:^|\W)onstart(?:\W|$)',
+-    r'(?:^|\W)onstop(?:\W|$)',
+-    r'(?:^|\W)onsubmit(?:\W|$)',
+-    r'(?:^|\W)onsync(?:from|to)preference(?:\W|$)',
+-    r'(?:^|\W)onsyncrestored(?:\W|$)',
+-    r'(?:^|\W)ontext(?:\W|$)',
+-    r'(?:^|\W)ontimeerror(?:\W|$)',
+-    r'(?:^|\W)ontrackchange(?:\W|$)',
+-    r'(?:^|\W)onunderflow(?:\W|$)',
+-    r'(?:^|\W)onurlflip(?:\W|$)',
+-    r'(?:^|\W)seeksegmenttime(?:\W|$)',
+-    r'(?:^|\W)svgabort(?:\W|$)',
+-    r'(?:^|\W)svgerror(?:\W|$)',
+-    r'(?:^|\W)svgload(?:\W|$)',
+-    r'(?:^|\W)svgresize(?:\W|$)',
+-    r'(?:^|\W)svgscroll(?:\W|$)',
+-    r'(?:^|\W)svgunload(?:\W|$)',
+-    r'(?:^|\W)svgzoom(?:\W|$)',
++    r'\bj(?:ava)?script\b',
++    r'\bvbs(?:cript)?\b',
++    r'\bdomactivate\b',
++    r'\bdomattrmodified\b',
++    r'\bdomcharacterdatamodified\b',
++    r'\bdomfocus(?:in|out)\b',
++    r'\bdommenuitem(?:in)?active\b',
++    r'\bdommousescroll\b',
++    r'\bdomnodeinserted(?:intodocument)?\b',
++    r'\bdomnoderemoved(?:fromdocument)?\b',
++    r'\bdomsubtreemodified\b',
++    r'\bfscommand\b',
++    r'\bonabort\b',
++    r'\bon(?:de)?activate\b',
++    r'\bon(?:after|before)print\b',
++    r'\bon(?:after|before)update\b',
++    r'\bonbefore(?:(?:de)?activate|copy|cut|editfocus|paste)\b',
++    r'\bonbeforeunload\b',
++    r'\bonbegin\b',
++    r'\bonblur\b',
++    r'\bonbounce\b',
++    r'\bonbroadcast\b',
++    r'\bon(?:cell)?change\b',
++    r'\boncheckboxstatechange\b',
++    r'\bon(?:dbl)?click\b',
++    r'\bonclose\b',
++    r'\boncommand(?:update)?\b',
++    r'\boncomposition(?:end|start)\b',
++    r'\boncontextmenu\b',
++    r'\boncontrolselect\b',
++    r'\boncopy\b',
++    r'\boncut\b',
++    r'\bondataavailable\b',
++    r'\bondataset(?:changed|complete)\b',
++    r'\bondrag(?:drop|end|enter|exit|gesture|leave|over)?\b',
++    r'\bondragstart\b',
++    r'\bondrop\b',
++    r'\bonend\b',
++    r'\bonerror(?:update)?\b',
++    r'\bonfilterchange\b',
++    r'\bonfinish\b',
++    r'\bonfocus(?:in|out)?\b',
++    r'\bonhelp\b',
++    r'\boninput\b',
++    r'\bonkey(?:up|down|press)\b',
++    r'\bonlayoutcomplete\b',
++    r'\bon(?:un)?load\b',
++    r'\bonlosecapture\b',
++    r'\bonmedia(?:complete|error)\b',
++    r'\bonmouse(?:down|enter|leave|move|out|over|up|wheel)\b',
++    r'\bonmove(?:end|start)?\b',
++    r'\bon(?:off|on)line\b',
++    r'\bonoutofsync\b',
++    r'\bonoverflow(?:changed)?\b',
++    r'\bonpage(?:hide|show)\b',
++    r'\bonpaint\b',
++    r'\bonpaste\b',
++    r'\bonpause\b',
++    r'\bonpopup(?:hidden|hiding|showing|shown)\b',
++    r'\bonprogress\b',
++    r'\bonpropertychange\b',
++    r'\bonradiostatechange\b',
++    r'\bonreadystatechange\b',
++    r'\bonrepeat\b',
++    r'\bonreset\b',
++    r'\bonresize(?:end|start)?\b',
++    r'\bonresume\b',
++    r'\bonreverse\b',
++    r'\bonrow(?:delete|enter|exit|inserted)\b',
++    r'\bonrows(?:delete|enter|inserted)\b',
++    r'\bonscroll\b',
++    r'\bonseek\b',
++    r'\bonselect(?:start)?\b',
++    r'\bonselectionchange\b',
++    r'\bonstart\b',
++    r'\bonstop\b',
++    r'\bonsubmit\b',
++    r'\bonsync(?:from|to)preference\b',
++    r'\bonsyncrestored\b',
++    r'\bontext\b',
++    r'\bontimeerror\b',
++    r'\bontrackchange\b',
++    r'\bonunderflow\b',
++    r'\bonurlflip\b',
++    r'\bseeksegmenttime\b',
++    r'\bsvgabort\b',
++    r'\bsvgerror\b',
++    r'\bsvgload\b',
++    r'\bsvgresize\b',
++    r'\bsvgscroll\b',
++    r'\bsvgunload\b',
++    r'\bsvgzoom\b',
+     ]
+ 
+ 
+-- 
+1.7.1
+

Modified: branches/lenny/debian/patches/series
===================================================================
--- branches/lenny/debian/patches/series	2011-02-16 19:11:49 UTC (rev 678)
+++ branches/lenny/debian/patches/series	2011-02-16 19:34:34 UTC (rev 679)
@@ -27,4 +27,5 @@
 78_DeprecationWarning.patch
 79_archiver_slash.patch
 80_fix_string_search.patch
+83-CVE-2010-3089--bug599833.patch
 99_js_templates.patch




More information about the Pkg-mailman-hackers mailing list