E-mails with "From" non-member and "Reply-to" member address pass through the rejection system
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
GNU Mailman |
Invalid
|
Undecided
|
Unassigned |
Bug Description
It seems that an email can pass through the rejection system if you send an email which:
1) is sent From a non-member address
2) uses a Reply-to of a member address
ubuntu-gr: https:/
ubuntu-cy: https:/
Both of these emails used the (1) and (2) mentioned above.
I've looked through the settings and couldn't find anything related to this.
Is there something that I missed and can be set to disable this behaviour?
P.S. Credits go to Nick Demou and Simos Xenitellis for discovering this vulnerability (if it happens to be one).
P.P.S. Attachment contains the email from ubuntu-cy with the headers included (password: bug).
visibility: | private → public |
Attaching the email from the sender too (password: bug)