diff options
| author | Mark Sapiro <mark@msapiro.net> | 2016-08-26 20:47:49 -0700 |
|---|---|---|
| committer | Mark Sapiro <mark@msapiro.net> | 2016-08-26 20:47:49 -0700 |
| commit | 97991cac52b604276f8751828d291c1b2002d9f7 (patch) | |
| tree | c6d8e4c94644797b7ac1839a6e9c11a101358606 /NEWS | |
| parent | 62d0aee0c31a90669bb053c5abeb9228c5a35996 (diff) | |
| download | mailman2-97991cac52b604276f8751828d291c1b2002d9f7.tar.gz mailman2-97991cac52b604276f8751828d291c1b2002d9f7.tar.xz mailman2-97991cac52b604276f8751828d291c1b2002d9f7.zip | |
Fixes for CVE-2016-6893 and more.
Diffstat (limited to 'NEWS')
| -rw-r--r-- | NEWS | 12 |
1 files changed, 11 insertions, 1 deletions
@@ -5,7 +5,17 @@ Copyright (C) 1998-2016 by the Free Software Foundation, Inc. Here is a history of user visible changes to Mailman. -2.1.23 (xx-xxx-xxxx) +2.1.23 (27-Aug-2016) + + Security + + - CSRF protection has been extended to the user options page. This was + actually fixed by Tokio Kikuchi as part of the fix for LP: #775294 and + intended for Mailman 2.1.15, but that fix wasn't completely merged at the + time. The full fix also addresses the admindb, and edithtml pages as + well as the user options page and the previously fixed admin pages. + Thanks to Nishant Agarwala for reporting the issue. CVE-2016-6893 + (LP: #1614841) New Features |