CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

Port details

mail/mailman-exim42.1.39_4

Mailing list manager with user-friendly web front-end

Maintainer
mandree@FreeBSD.org
Packages
mailman-exim4 2.1.39_4
Upstream
Higher version available: 3.3.10
CPE
gnu:mailman from the port
WWW
https://www.list.org/
Links
cgit · VuXML

Unaddressed (4) · The CVE record lists this version as affected, no VuXML entry names the CVE

CVE-2021-343376.3published 2023-04-15

An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on ot…

CVE-2025-439195.8published 2025-04-20

GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the private archive authentication endpoint) via the username parameter. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is u…

CVE-2025-439205.4published 2025-04-20

GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.

CVE-2025-439215.3published 2025-04-20

GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (2)

VuXML entries whose affected range this version has left.

Commits (2)

Tobias C. Berner (tcberner) · 2.1.39_4
mail: remove 'Created by' lines

A big Thank You to the original contributors of these ports:

  *  <ashish@FreeBSD.org>
  *  Aaron Dalton <aaron@FreeBSD.org>
  *  Adam David <adam@FreeBSD.org>
  *  Adam McDougall <mcdouga9@egr.msu.edu>
  *  Adam Weinberger <adamw@FreeBSD.org>
  *  Ade Lovett <ade@FreeBSD.org>
  *  Akinori MUSHA aka knu <knu@idaemons.org>
  *  Alex Deiter <tiamat@komi.mts.ru>
  *  Alex Dupre <ale@FreeBSD.org>
  *  Alex Dupre <sysadmin@alexdupre.com>
  *  Alex Perel <veers@disturbed.net>
  *  Alexander Kriventsov <avk@vl.ru>
  *  Alexander Logvinov <info@logvinov.com>
  *  Alexander Moisseev <moiseev@mezonplus.ru>
  *  Alexander Wittig <alexander@wittig.name>
  *  Alexander Zhuravlev <zaa@zaa.pp.ru>
  *  Alexandre Biancalana <ale@biancalanas.net>
  *  Alexey V. Degtyarev
  *  Alexey V. Degtyarev <alexey@renatasystems.org>
  *  Ali Mashtizadeh <ali@mashtizadeh.org>
  *  Anders Nordby <anders@FreeBSD.org>
  *  Anders Nordby <anders@fix.no>
  *  Andrea Venturoli <freebsd@netfence.it>
  *  Andrew J. Caines <A.J.Caines@halplant.com>
  *  Andrew Pantyukhin <infofarmer@FreeBSD.org>
  *  Andrew Stevenson <andrew@ugh.net.au>
  *  Andrey Slusar <anray@FreeBSD.org>
  *  Andrey V. Pevnev <andrey@mgul.ac.ru>
  *  Andrey Zakhvatov
  *  Andy Gilligan
  *  Anthony Kim
  *  Anton Berezin <tobez@FreeBSD.org>
  *  Anton Berezin <tobez@tobez.org>
  *  Anton Karpov <toxa@toxahost.ru>
  *  Anton Lysenok <bart@tapolsky.net.ua>
  *  Anton Yuzhaninov <citrin@rambler-co.ru>
  *  Antonio Carlos Venancio Junior (<antonio@inf.ufsc.br>)
  *  Ashish SHUKLA <ashish@FreeBSD.org>
  *  Attila Nagy <bra@fsn.hu>
  *  Autrijus Tang <autrijus@autrijus.org>
  *  Axel Steiner <ast@treibsand.com>
  *  Ben Smithurst <ben@FreeBSD.org>
  *  Bernard Spil <brnrd@FreeBSD.org>
  *  Bernard Spil <brnrd@freebsd.org>
  *  Bill Brinzer <bill.brinzer@gmail.com>
  *  Cheng-Lung Sung <clsung@FreeBSD.org>
  *  Cheng-Lung Sung <clsung@dragon2.net>
  *  Chifeng QU <chifeng@gmail.com>
  *  Chris D. Faulhaber <jedgar@fxp.org>
  *  Chris Piazza <cpiazza@FreeBSD.org>
  *  Christer Edwards <christer.edwards@gmail.com>
  *  Christian Laursen <xi@borderworlds.dk>
  *  Christopher Elkins <chrise@scardini.com>
  *  Clement Laforet <sheepkiller@cultdeadsheep.org>
  *  Craig Leres <leres@FreeBSD.org>
  *  Cyril Guibourg
  *  CyrilM <cyrilm@tower.pp.ru>
  *  Dan Langille <dvl@FreeBSD.org>
  *  Daniel Roethlisberger <daniel@roe.ch>
  *  Dario Freni <saturnero@gufi.org>
  *  Darren Pilgrim <ports.maintainer@evilphi.com>
  *  DarwinSurvivor <darwinsurvivor@gmail.com>
  *  David Bushong <david+ports@bushong.net>
  *  David O'Brien (obrien@NUXI.com)
  *  David Siebörger <drs@rucus.ru.ac.za>
  *  Dean Hollister <dean@odyssey.apana.org.au>
  *  Dmitry Liakh <dliakh@ukr.net>
  *  Dmitry Sivachenko <demon@FreeBSD.org>
  *  Dominic Marks <dom@wirespeed.org.uk>
  *  Eivind Eklund <eivind@FreeBSD.org>
  *  Emanuel Haupt <ehaupt@FreeBSD.org>
  *  Emanuel Haupt <ehaupt@critical.ch>
  *  Emmanuel Vadot <manu@FreeBSD.org>
  *  Eric Freeman <freebsdports@chillibear.com>
  *  Erwin Lansing <erwin@FreeBSD.org>
  *  Eugene M. Kim <ab@astralblue.net>
  *  Fukang Chen <loader@FreeBSD.org>
  *  Gea-Suan Lin (gslin@ccca.nctu.edu.tw)
  *  Gea-Suan Lin <gslin@gslin.org>
  *  George Reid <greid@ukug.uk.freebsd.org>
  *  Gerhard Gonter <g.gonter@ieee.org>
  *  Gerrit Beine <gerrit.beine@gmx.de>
  *  Giel van Schijndel <me@mortis.eu>
  *  Glen Barber <gjb@FreeBSD.org>
  *  Glenn Johnson <gljohns@bellsouth.net>
  *  Gregory Sutter <gsutter@zer0.org>
  *  Gustau Perez <gustau.perez@gmail.com>
  *  Guy Antony Halse <guy@rucus.ru.za.za>
  *  Hajimu UMEMOTO <ume@FreeBSD.org>
  *  Harry Newton
  *  Hirohisa Yamaguchi <umq@ueo.co.jp>
  *  Hsin-Han You <hhyou@cs.nctu.edu.tw>
  *  Ion-Mihai "IOnut" Tetcu <itetcu@FreeBSD.org>
  *  Issei Suzuki <issei@jp.FreeBSD.org>
  *  J.R. Oldroyd <fbsd@opal.com>
  *  Jaap Akkerhuis <jaap@NLnetLabs.nl>
  *  James FitzGibbon <jfitz@FreeBSD.org>
  *  James Raftery <james@now.ie>
  *  Jan-Peter Koopmann <j.koopmann@seceidos.de>
  *  Janne Snabb <snabb@epipe.com>
  *  Jean Milanez Melo <jmelo@FreeBSD.org>
  *  Jean-Baptiste Quenot <jb.quenot@caraldi.com>
  *  Jeremy Norris <ishmael27@home.com>
  *  Jim Mock <jim@FreeBSD.org>
  *  Jin-Shan Tseng <tjs@cdpa.nsysu.edu.tw>
  *  Joe Marcus Clarke <marcus@FreeBSD.org>
  *  Johann Visagie <wjv@FreeBSD.org>
  *  Johannes Meixner <johannes@perceivon.net>
  *  John Oxley <john@yoafrica.com>
  *  John Prather
  *  Josh Gilliam <josh@quick.net>
  *  Jun-ichiro Hagino <itojun@itojun.org>
  *  Justin Stanford <jus@security.za.net>
  *  KIMURA Yasuhiro <yasu@utahime.org>
  *  Kay Abendroth <kay.abendroth@raxion.net>
  *  Keith Gaughan <k@stereochro.me>
  *  Kelly Yancey <kbyanc@FreeBSD.org>
  *  Kevin Golding <ports@caomhin.org>
  *  Kimura Fuyuki <fuyuki@mj.0038.net>
  *  Kirill Ponomarew <ponomarew@oberon.net>
  *  Kiriyama Kazuhiko <kiri@kiri.toba-cmt.ac.jp>
  *  Konstantinos Konstantinidis <kkonstan@daemon.gr>
  *  Koop Mast <kwm@FreeBSD.org>
  *  Krzysztof Stryjek <ports@bsdserwis.com>
  *  Larry Rosenman <ler@FreeBSD.org>
  *  Lars Koeller <Lars_Koeller@odie.physik2.uni-rostock.de>
  *  Lars Thegler <lars@thegler.dk>
  *  Lars Thegler <lth@FreeBSD.org>
  *  Lasse L. Johnsen (lasse@freebsdcluster.org)
  *  Lefteris Chatzibarbas <lefcha@hellug.gr>
  *  Lukasz Wasikowski <lukasz@wasikowski.net>
  *  MANTANI Nobutaka <nobutaka@nobutaka.com>
  *  Marcelo Araujo <araujobsd@gmail.com>
  *  Marco Broeder <marco.broeder@posteo.eu>
  *  Marcus Alves Grando <mnag@FreeBSD.org>
  *  Marijn Meijles <marijn@stack.nl>
  *  Mario S F Ferreira <lioux@FreeBSD.org>
  *  Mario S F Ferreira <lioux@linf.unb.br>
  *  Mario S F Ferreira <lioux@linf.unb.br> # Created by Matthias Andree
  *  Mario Sergio Fujikawa Ferreira <lioux@FreeBSD.org>
  *  Mark Felder <feld@FreeBSD.org>
  *  Mark Starovoytov <mark_sf@kikg.ifmo.ru>
  *  Martin Blapp
  *  Martin Matuska <mm@FreeBSD.org>
  *  Martin Wilke (miwi@FreeBSD.org)
  *  Martin Wilke <miwi@FreeBSD.org>
  *  Martti Kuparinen <martti.kuparinen@ericsson.com>
  *  Masafumi NAKANE <max@FreeBSD.org>
  *  Masafumi Otsune <info@otsune.com>
  *  Masaki TAGAWA <masaki@club.kyutech.ac.jp>
  *  Matt Emmerton <matt@gsicomp.on.ca>
  *  Matthew Luckie <mjl@luckie.org.nz>
  *  Matthew N. Dodd <mdodd@FreeBSD.org>
  *  Matthew Seaman
  *  Matthew Seaman <matthew@FreeBSD.org>
  *  Matthias Andree <mandree@FreeBSD.org>
  *  Matthias Andree <matthias.andree@gmx.de>
  *  Matthias Fechner <mfechner@FreeBSD.org>
  *  Max Laier <max@love2party.net>
  *  Maxim Sobolev <sobomax@FreeBSD.org>
  *  Maxim Tulyuk <mt@primats.org.ua>
  *  Meno Abels <meno.abels@adviser.com>
  *  Michael L. Hostbaek (mich@freebsdcluster.org)
  *  Michael Ranner <michael@ranner.eu>
  *  Miguel Mendez <flynn@energyhq.es.eu.org>
  *  Mij <mij@bitchx.it>
  *  Mikhail T. (m.tsatsenko@gmail.com)
  *  Mikhail Teterin
  *  Miroslav Lachman
  *  Mohammad S. Babaei <info@babaei.net>
  *  Murilo Opsfelder <mopsfelder@gmail.com>
  *  Nagy, Attila <bra@fsn.hu>
  *  Nate Underwood <natey@natey.com>
  *  Neil Blakey-Milner
  *  Neil Blakey-Milner <nbm@FreeBSD.org>
  *  Neil Blakey-Milner <nbm@rucus.ru.ac.za>
  *  Neil Darlow <neil@darlow.co.uk>
  *  Nemo Liu <nemoliu@FreeBSD.org>
  *  Netherby <netherby@dancingfortune.com>
  *  Nick Hilliard <nick@foobar.org>
  *  Nils Vogels <nivo+kw+ports.bfa274@is-root.com>
  *  Oliver Braun
  *  Oliver Braun <obraun@FreeBSD.org>
  *  Oliver Eikemeier
  *  Oliver Eikemeier <eik@FreeBSD.org>
  *  Oliver Eikemeier <eikemeier@fillmore-labs.com>
  *  Olivier Cochard-Labbe <olivier@FreeBSD.org>
  *  Olivier Girard <Olivier.Girard@univ-angers.fr>
  *  Omer Faruk Sen <ofsen@enderunix.org>
  *  Ozkan KIRIK <ozkan@enderunix.org>
  *  Pav Lucistnik <pav@FreeBSD.org>
  *  Pawel Pekala <c0rn@o2.pl>
  *  Pawel Pekala <pawel@FreeBSD.org>
  *  Pawel Pekala <pawel@freebsd.org>
  *  Pete Fritchman <petef@databits.net >
  *  Peter Hollaubek <fifteen@inext.hu>
  *  Peter Kieser <peter@kieser.ca>
  *  Peter Pentchev <roam@FreeBSD.org>
  *  Peter Wemm <peter@FreeBSD.org>
  *  Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  R.I.Pienaar <rip@devco.net>
  *  Radim Kolar
  *  RicardoSSP <ricardo.katz@gmail.com>
  *  Rob Evers <rob@debank.tv>
  *  Robert Felber <robtone@ek-muc.de>
  *  Robert Nelson <robertn@the-nelsons.org>
  *  Romain Tartiere <romain@blogreen.org>
  *  Rozhuk Ivan <rozhuk.im@gmail.com>
  *  Ryan Steinmetz <zi@FreeBSD.org>
  *  Sahil Tandon <sahil@tandon.net>
  *  Satoru Suzuki <xsuzu@yokohama.riken.jp>
  *  Scott Blachowicz <scott+ports@sabami.seaslug.org>
  *  Scott Lambert <lambert@lambertfam.org>
  *  Sean Chittenden <seanc@FreeBSD.org>
  *  Sergei Kolobov <sergei@FreeBSD.org>
  *  Sergei Kolobov <sergei@kolobov.com>
  *  Sergey A. Osokin <osa@FreeBSD.org>
  *  Sergey Matveychuk <sem@FreeBSD.org>
  *  Sergey Samoyloff <gonza@techline.ru>
  *  Sergey Skvortsov <skv@FreeBSD.org>
  *  Sergey Skvortsov <skv@protey.ru>
  *  Shaun Amott <shaun@FreeBSD.org>
  *  Sheldon Hearn <sheldonh@FreeBSD.org>
  *  Simon 'corecode' Schubert <corecode@corecode.ath.cx>
  *  Simon Barner <barner@in.tum.de>
  *  Simon Dick <simond@irrelevant.org>
  *  Stefan A. Deutscher (sad@mailaps.org)
  *  Stefan Bethke <stb@lassitu.de>
  *  Stephen Roznowski <sjr1@flash.net>
  *  Stephon Chen <stephon@pixnet.tw>
  *  Steve Wills <swills@FreeBSD.org>
  *  Steven Kreuzer <skreuzer@f2o.org>
  *  Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  Sylvio Cesar <sylvio@FreeBSD.org>
  *  TAKAHASHI Kaoru <kaoru@kaisei.org>
  *  TAKATSU Tomonari <tota@rtfm.jp>
  *  Talal Al-Dik <tad@vif.com>
  *  Ted Faber <faber@isi.edu>
  *  Terry Sposato
  *  The Anarcat <anarcat@anarcat.ath.cx>
  *  Thierry Thomas (<thierry@pompo.net>)
  *  Thomas Abthorpe <thomas@goodking.ca>
  *  Thomas Gellekum <tg@FreeBSD.org>
  *  Thomas Lotterer <thomas.lotterer@cw.com>
  *  Thomas Seck <tmseck@netcologne.de>
  *  Tim Bishop <tim@bishnet.net>
  *  Tom Hukins <tom@eborcom.com>
  *  Tom Judge <tj@FreeBSD.org>
  *  Tom McLaughlin <tmclaugh@sdf.lonestar.org>
  *  Tomasz Paszkowski <ns88@k.pl>
  *  Torsten Blum <torstenb@FreeBSD.org>
  *  Torsten Zuehlsdorff <ports@toco-domains.de>
  *  Trish Lynch <trish@bsdunix.net>
  *  Tsung-Han Yeh <snowfly@yuntech.edu.tw>
  *  Tuc <freebsd-ports@t-b-o-h.net>
  *  Udo Schweigert
  *  Udo Schweigert <ust@cert.siemens.de>
  *  Uffe Jakobsen <uffe@uffe.org>
  *  Victor Balada Diaz <victor@bsdes.net>
  *  Vidar Karlsen <vidar@karlsen.tech>
  *  Ville Eerola <ve@sci.fi>
  *  Vivek Khera <vivek@khera.org>
  *  Vladimir Kondratiev <wulf@mail.mipt.ru>
  *  Vsevolod Lobko <seva@sevasoft.kiev.ua>
  *  Vsevolod Stakhov <vsevolod@highsecure.ru>
  *  Wei-chun Chao
  *  Wen Heping <wen@FreeBSD.org>
  *  Will Andrews <will@FreeBSD.org>
  *  Xavier Beaudouin <kiwi@oav.net>
  *  Yarema <yds@CoolRat.org>
  *  Yasuhiro KIMURA <yasu@utahime.org>
  *  Yen-Ming Lee <leeym@FreeBSD.org>
  *  Yen-Ming Lee <leeym@cae.ce.ntu.edu.tw>
  *  Yen-Ming Lee <leeym@leeym.com>
  *  Yoshiro MIHIRA <sanpei@yy.cs.keio.ac.jp>
  *  Yoshisato YANAGISAWA
  *  Zak Johnson <zakj@nox.cx>
  *  Zane C. Bowers
  *  Zeus Panchenko <zeus@gnu.org.ua>
  *  Zhen REN <bg1tpt@gmail.com>
  *  ache
  *  ache@FreeBSD.org
  *  arensb@ooblick.com
  *  bremner@unb.ca
  *  brett@peloton.physics.montana.edu
  *  bsam
  *  chinsan
  *  chris
  *  chris@shagged.org
  *  clive
  *  clsung
  *  clsung@dragon2.net
  *  dchapes@zeus.leitch.com
  *  delphij@FreeBSD.org
  *  delphij@FreeBSD.org.cn
  *  dhagan@cs.vt.edu
  *  dliakh
  *  dlowe
  *  dm
  *  eivind
  *  fluffy
  *  gahr
  *  gmarco@scotty.masternet.it
  *  gmc@sonologic.nl
  *  ijliao
  *  ismail@enderunix.org
  *  itojun@itojun.org
  *  janos.mohacsi@bsd.hu
  *  johnpupu <johnpupu@gmail.com>
  *  kaz
  *  krion
  *  liamfoy@sepulcrum.org
  *  markm@FreeBSD.org
  *  matusita@FreeBSD.org
  *  mich@freebsdcluster.org
  *  mwest@uct.ac.za
  *  n_hibma@qubesoft.com
  *  nbm
  *  nork@FreeBSD.org
  *  ofsen@enderunix.org
  *  pat
  *  petef
  *  petef@FreeBSD.org
  *  pst
  *  punkt.de Hosting Team <mops@punkt.de>
  *  rea@FreeBSD.org
  *  roam@FreeBSD.org
  *  sheldonh@FreeBSD.org
  *  shigeri <shigeri@m10.alpha-net.ne.jp>
  *  snowchyld
  *  tobez@tobez.org
  *  torstenb
  *  trevor
  *  v.velox@vvelox.net
  *  vanilla
  *  will
  *  wolpert

With hat:	portmgr
b587cc2b4d
Matthias Andree (mandree)
mailman: add -postfix and -exim4 slave ports

This is to avoid accidents on upgrading, for instance, if
the POSTFIX option is getting lost and mail starts to bounce.

The slave ports prevent that.
9bdca52216