CVE-2006-4624

Published: Sep 7, 2006Modified: Apr 16, 2026

2.6

Vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability: 4.9 / Impact: 2.9

Source: NVD

Description

CRLF injection vulnerability in Utils.py in Mailman before 2.1.9rc1 allows remote attackers to spoof messages in the error log and possibly trick the administrator into visiting malicious URLs via CRLF sequences in the URI.

Affected (1)

Products: Gnu: Mailman

Gnu

1 product

Mailman

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gnu Mailman	Up to 2.1.8

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (42)

http://mail.python.org/pipermail/mailman-announce/2006-September/000087.html

Source: cve@mitre.org

http://moritz-naumann.com/adv/0013/mailmanmulti/0013.txt

Source: cve@mitre.org

http://secunia.com/advisories/21732

Source: cve@mitre.org

PatchVendor Advisory

http://secunia.com/advisories/22011

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/22020

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/22227

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/22639

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27669

Source: cve@mitre.org

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200609-12.xml

Source: cve@mitre.org

http://sourceforge.net/project/shownotes.php?group_id=103&release_id=444295

Source: cve@mitre.org

Patch

http://svn.sourceforge.net/viewvc/mailman/trunk/mailman/Mailman/Utils.py?r1=7859&r2=7923

Source: cve@mitre.org

http://www.debian.org/security/2006/dsa-1188

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDKSA-2006:165

Source: cve@mitre.org

http://www.novell.com/linux/security/advisories/2006_25_sr.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-0779.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/445992/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/19831

Source: cve@mitre.org

http://www.securityfocus.com/bid/20021

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2006/3446

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/28734

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9756

Source: cve@mitre.org

http://mail.python.org/pipermail/mailman-announce/2006-September/000087.html