Scrubbed application/octet-stream parts should not have .obj extension

Bug #1886117 reported by Mark Sapiro
This bug affects 1 person
Affects Status Importance Assigned to Milestone
GNU Mailman
Fix Released

Bug Description

This was fixed in Mailman 2.1.30 by using .bin for the extension, but a bug report was never created.

The issue prior to 2.1.30 was a scrubbed attachment with no extension in it's name would be saved with a .obj extension and some web servers and or browsers would not recognize the .obj extension and possibly serve evil javascript as html.

For more info see

CVE References

Mark Sapiro (msapiro)
description: updated
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.