!33 [sync] PR-29: Fix CVE-2021-44227

From: @openeuler-sync-bot
Reviewed-by: @small_leek
Signed-off-by: @small_leek

CVE-2021-44227.patch

@@ -0,0 +1,85 @@
+diff --git a/Mailman/CSRFcheck.py b/Mailman/CSRFcheck.py
+index 24e3e11..81998cf 100644
+--- a/Mailman/CSRFcheck.py
++++ b/Mailman/CSRFcheck.py
+@@ -55,7 +55,7 @@ def csrf_token(mlist, contexts, user=None):
+     token = binascii.hexlify(marshal.dumps((issued, keymac)))
+     return token
+ 
+-def csrf_check(mlist, token, options_user=None):
++def csrf_check(mlist, token, cgi_user=None):
+     """ check token by mailman cookie validation algorithm """
+     try:
+         issued, keymac = marshal.loads(binascii.unhexlify(token))
+@@ -67,12 +67,25 @@ def csrf_check(mlist, token, options_user=None):
+             key, user = key.split('+', 1)
+         else:
+             user = None
++        # Don't allow unprivileged tokens for admin or admindb.
++        if cgi_user == 'admin':
++            if key not in ('admin', 'site'):
++                syslog('mischief',
++                       'admin form submitted with CSRF token issued for %s.',
++                       key + '+' + user if user else key)
++                return False
++        elif cgi_user == 'admindb':
++            if key not in ('moderator', 'admin', 'site'):
++                syslog('mischief',
++                       'admindb form submitted with CSRF token issued for %s.',
++                       key + '+' + user if user else key)
++                return False
+         if user:
+             # This is for CVE-2021-42097.  The token is a user token because
+             # of the fix for CVE-2021-42096 but it must match the user for
+             # whom the options page is requested.
+             raw_user = UnobscureEmail(urllib.unquote(user))
+-            if options_user and options_user != raw_user:
++            if cgi_user and cgi_user != raw_user:
+                 syslog('mischief',
+                        'Form for user %s submitted with CSRF token '
+                        'issued for %s.',
+diff --git a/Mailman/Cgi/admin.py b/Mailman/Cgi/admin.py
+index b5f1482..a25d7e7 100644
+--- a/Mailman/Cgi/admin.py
++++ b/Mailman/Cgi/admin.py
+@@ -107,7 +107,8 @@ def main():
+                    'legend']
+     params = cgidata.keys()
+     if set(params) - set(safe_params):
+-        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
++        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
++                                  'admin')
+     else:
+         csrf_checked = True
+     # if password is present, void cookie to force password authentication.
+diff --git a/Mailman/Cgi/admindb.py b/Mailman/Cgi/admindb.py
+index 32b0be7..640cd0e 100644
+--- a/Mailman/Cgi/admindb.py
++++ b/Mailman/Cgi/admindb.py
+@@ -143,7 +143,8 @@ def main():
+     safe_params = ['adminpw', 'admlogin', 'msgid', 'sender', 'details']
+     params = cgidata.keys()
+     if set(params) - set(safe_params):
+-        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
++        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
++                                  'admindb')
+     else:
+         csrf_checked = True
+     # if password is present, void cookie to force password authentication.
+diff --git a/Mailman/Cgi/edithtml.py b/Mailman/Cgi/edithtml.py
+index 1dd9e87..170e811 100644
+--- a/Mailman/Cgi/edithtml.py
++++ b/Mailman/Cgi/edithtml.py
+@@ -111,7 +111,8 @@ def main():
+     safe_params = ['VARHELP', 'adminpw', 'admlogin']
+     params = cgidata.keys()
+     if set(params) - set(safe_params):
+-        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
++        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
++                                  'admin')
+     else:
+         csrf_checked = True
+     # if password is present, void cookie to force password authentication.
+-- 
+2.27.0
+

mailman.spec

@@ -2,8 +2,8 @@
 %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}}
 
 Name:           mailman
-Version:        2.1.29
-Release:        5
+Version:        2.1.36
+Release:        2
 Epoch:          3
 Summary:        GNU Mailing List Manager
 License:        GPLv2+
@@ -27,6 +27,7 @@ Patch7:         mailman-2.1.13-archive-reply.patch
 Patch13:        mailman-2.1.9-unicode.patch
 Patch21:        mailman-2.1.13-env-python.patch
 Patch22:        mailman-2.1.15-check_perms.patch
+Patch23:        CVE-2021-44227.patch
 
 BuildRequires:  automake gcc python2-devel systemd python2-dns
 Requires(pre):  shadow-utils
@@ -421,5 +422,21 @@ exit 0
 %dir %attr(775,root,%{name}) /var/lock/%{name}
 
 %changelog
+* Sat Dec 4 2021 yaoxin <yaoxin30@huawei.com> - 2.1.36-2
+- Fix CVE-2021-44227
+
+* Thu Nov 18 2021 houyingchao <houyingchao@huawei.com> - 2.1.36-1
+- Upgrade to 2.1.36
+- Fix CVE-2021-43332 CVE-2021-43331
+
+* Tue Oct 26 2021 wangkai <wangkai385@huawei.com> - 2.1.29-8 
+- Fix CVE-2021-42096
+
+* Mon Oct 25 2021 yaoxin <yaoxin30@huawei.com> - 2.1.29-7
+- Fix CVE-2020-15011
+
+* Tue Oct 19 2021 liwu <liwu13@huawei.com> - 2.1.29-6
+- Fix CVE-2020-12108 CVE-2020-12137
+
 * Fri Feb 14 2020 lihao <lihao129@huawei.com> - 2.1.29-5
 - Package init