CVE-2020-15011 Code injection in n/a

Medium 4.3 Published 24 Jun 2020 Updated 4 Aug 2024

Attackers can inject arbitrary content via the private archive login page, potentially leading to code execution in GNU Mailman installations.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2020-15011?

CVE-2020-15011 is a medium-severity code injection vulnerability in Canonical Ubuntu Linux, published on 24 Jun 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page.

Weakness: CWE-74

Which versions are affected by CVE-2020-15011?

It affects 3 products.

Linux distribution packages (19)

`mailman` SUSE:Enterprise Storage 5	All versions	`2.1.17-3.23.1`
`mailman` SUSE:HPE Helion OpenStack 8	All versions	`2.1.17-3.23.1`
`mailman` SUSE:Linux Enterprise Point of Sale 11 SP3	All versions	`2.1.15-9.6.26.1`
`mailman` SUSE:Linux Enterprise Server 11 SP4-LTSS	All versions	`2.1.15-9.6.26.1`
`mailman` SUSE:Linux Enterprise Server 12 SP2-BCL	All versions	`2.1.17-3.23.1`
`mailman` SUSE:Linux Enterprise Server 12 SP2-LTSS	All versions	`2.1.17-3.23.1`
`mailman` SUSE:Linux Enterprise Server 12 SP3-BCL	All versions	`2.1.17-3.23.1`
`mailman` SUSE:Linux Enterprise Server 12 SP3-LTSS	All versions	`2.1.17-3.23.1`
`mailman` SUSE:Linux Enterprise Server 12 SP4-LTSS	All versions	`2.1.17-3.23.1`
`mailman` SUSE:Linux Enterprise Server 12 SP5	All versions	`2.1.17-3.23.1`
`mailman` SUSE:Linux Enterprise Server for SAP Applications 12 SP2	All versions	`2.1.17-3.23.1`
`mailman` SUSE:Linux Enterprise Server for SAP Applications 12 SP3	All versions	`2.1.17-3.23.1`
`mailman` SUSE:Linux Enterprise Server for SAP Applications 12 SP4	All versions	`2.1.17-3.23.1`
`mailman` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`2.1.17-3.23.1`
`mailman` SUSE:OpenStack Cloud 7	All versions	`2.1.17-3.23.1`
`mailman` SUSE:OpenStack Cloud 8	All versions	`2.1.17-3.23.1`
`mailman` SUSE:OpenStack Cloud 9	All versions	`2.1.17-3.23.1`
`mailman` SUSE:OpenStack Cloud Crowbar 8	All versions	`2.1.17-3.23.1`
`mailman` SUSE:OpenStack Cloud Crowbar 9	All versions	`2.1.17-3.23.1`

Products include Canonical Ubuntu Linux, Debian Debian Linux, Gnu Mailman.

How do I fix CVE-2020-15011?

Upgrade to a fixed version.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2020-15011 being exploited?

There is no known exploitation of CVE-2020-15011 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as DLA-2265-1, GHSA-fvg8-xwx7-9x5m, SUSE-SU-2020:14423-1, SUSE-SU-2020:2048-1, UBUNTU-CVE-2020-15011, USN-4406-1.