- Update to 2.1.39

- Update to 2.1.37
  - A bug in the fix for CVE-2021-43332 has been fixed.  (LP: #1950833)
  - Fixed a potential XSS attack via the user options page CVE-2021-43331)
  - Fixed a potential for a list moderator to carry out an off-line
    brute force attack to obtain the list admin password
    CVE-2021-43332 (LP: #1949403)

- Update to 2.1.35 to fix 2 security issues: 
  - A potential for for a list member to carry out an off-line brute force
    attack to obtain the list admin password has been reported by Andre
    Protas, Richard Cloke and Andy Nuttall of Apple.  This is fixed.
    CVE-2021-42096  (boo#1191959, LP:#1947639)
 
  - A CSRF attack via the user options page could allow takeover of a users
    account.  This is fixed.  CVE-2021-42097  (boo#1191960, LP:#1947640)

- Update to 2.1.34:
  - The fix for lp#1859104 can result in ValueError being thrown
    on attempts to subscribe to a list. This is fixed and
    extended to apply REFUSE_SECOND_PENDING to unsubscription as
    well. (lp#1878458)
  - DMARC mitigation no longer misses if the domain name returned
    by DNS contains upper case. (lp#1881035)
  - A new WARN_MEMBER_OF_SUBSCRIBE setting can be set to No to
    prevent mailbombing of a member of a list with private
    rosters by repeated subscribe attempts. (lp#1883017)
  - Very long filenames for scrubbed attachments are now
    truncated. (lp#1884456)

• Browse Source