From 5ea7ee4e955d96177e461b0a1f2c2be04df12ea8 Mon Sep 17 00:00:00 2001 From: Mark Sapiro Date: Mon, 18 Oct 2021 16:56:42 -0700 Subject: Fixes for CVEs 2021-42096 and 2021-42097. --- Mailman/SecurityManager.py | 1 + 1 file changed, 1 insertion(+) (limited to 'Mailman/SecurityManager.py') diff --git a/Mailman/SecurityManager.py b/Mailman/SecurityManager.py index 9b7f03f3..e9e5ce53 100644 --- a/Mailman/SecurityManager.py +++ b/Mailman/SecurityManager.py @@ -104,6 +104,7 @@ class SecurityManager: if user is None: # A bad system error raise TypeError, 'No user supplied for AuthUser context' + user = Utils.UnobscureEmail(urllib.unquote(user)) secret = self.getMemberPassword(user) userdata = urllib.quote(Utils.ObscureEmail(user), safe='') key += 'user+%s' % userdata -- cgit v1.2.3