Sync mailman 1:2.1.14-1 (main) from Debian unstable (main)

[Dave Walker]

Please sync mailman 1:2.1.14-1 (main) from Debian unstable (main)

Changelog entries since current natty version 1:2.1.13-4.1:

mailman (1:2.1.14-1) unstable; urgency=medium

  * New upstream release. Patches incorporated:
    - 15_mailmanctl_daemonize.patch
    - 83-CVE-2010-3089--bug599833.patch
  * Add upstream patch for CVE-2011-0707: XSS in confirmations.

 -- Thijs Kinkhorst <email address hidden> Sat, 19 Feb 2011 08:26:43 +0100

[Benjamin Drung (bdrung)]

mailman 1:2.1.14-1 builds on amd64. Sync request ACK'd.

[Bob Tanner (tanner)]

As a remotely exploitable security issue I hope the Importance of this issue is greater then Wishlist!

[Benjamin Drung (bdrung)]

The package will be synced regardless of the Importance. Changing the Importance won't get it processed faster. Besides that, the development release (currently natty) has no security support. We have to fix security holes till the release, but not earlier.

Does this security issue affects other series too?

[Dave Walker (davewalker)]

@bdrung, I had already confirmed the Ubuntu security team are working on -security updates for stable releases.

[Colin Watson (cjwatson)]

[Updating] mailman (1:2.1.13-4.1 [Ubuntu] < 1:2.1.14-1 [Debian])
 * Trying to add mailman...
2011-02-22 12:36:47 INFO - <mailman_2.1.14.orig.tar.gz: downloading from http://ftp.debian.org/debian/>
2011-02-22 12:36:50 INFO - <mailman_2.1.14-1.debian.tar.gz: downloading from http://ftp.debian.org/debian/>
2011-02-22 12:36:50 INFO - <mailman_2.1.14-1.dsc: downloading from http://ftp.debian.org/debian/>
I: mailman [main] -> mailman_1:2.1.13-4.1 [main].