diff options
Diffstat (limited to 'NEWS')
| -rw-r--r-- | NEWS | 12 |
1 files changed, 11 insertions, 1 deletions
@@ -5,7 +5,17 @@ Copyright (C) 1998-2016 by the Free Software Foundation, Inc. Here is a history of user visible changes to Mailman. -2.1.23 (xx-xxx-xxxx) +2.1.23 (27-Aug-2016) + + Security + + - CSRF protection has been extended to the user options page. This was + actually fixed by Tokio Kikuchi as part of the fix for LP: #775294 and + intended for Mailman 2.1.15, but that fix wasn't completely merged at the + time. The full fix also addresses the admindb, and edithtml pages as + well as the user options page and the previously fixed admin pages. + Thanks to Nishant Agarwala for reporting the issue. CVE-2016-6893 + (LP: #1614841) New Features |