CVE-2020-12108

Name	CVE-2020-12108
Description	/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2204-1, DLA-2276-1, DSA-4991-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mailman (PTS)	buster	1:2.1.29-1+deb10u5	fixed
	buster (security)	1:2.1.29-1+deb10u2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
mailman	source	jessie	1:2.1.18-2+deb8u6	DLA-2204-1
mailman	source	stretch	1:2.1.23-1+deb9u6	DLA-2276-1
mailman	source	buster	1:2.1.29-1+deb10u2	DSA-4991-1
mailman	source	(unstable)	(unfixed)

https://bugs.launchpad.net/mailman/+bug/1873722
Fixed by: https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1844