CVE catalog

CVE-2020-12137

UBUNTU-CVE-2020-12137

[CVE catalog]

Severity
Medium · CVSS 6.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
2.29% · Oct 25, 2026

GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code. mailman: XSS via file attachments in list archives The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmailman91:2.1.23-1vulnerable
Debianmailman91:2.1.23-1+deb9u1vulnerable
Debianmailman91:2.1.23-1+deb9u2vulnerable
Debianmailman91:2.1.23-1+deb9u3vulnerable
Debianmailman91:2.1.23-1+deb9u4vulnerable
Debianmailman91:2.1.23-1+deb9u5fixed
Debianmailman101:2.1.29-1vulnerable
Debianmailman101:2.1.29-1+deb10u1fixed
Debianmailman81:2.1.18-2vulnerable
Debianmailman81:2.1.18-2+deb8u1vulnerable
Debianmailman81:2.1.18-2+deb8u2vulnerable
Debianmailman81:2.1.18-2+deb8u3vulnerable
Debianmailman81:2.1.18-2+deb8u4vulnerable
Debianmailman81:2.1.18-2+deb8u5fixed
Susemailmanlinux enterprise point of sale 11 sp32.1.15-9.6.20.1fixed
Susemailmanlinux enterprise server 11 sp4-ltss2.1.15-9.6.20.1fixed
Ubuntumailman16.041:2.1.20-1vulnerable
Ubuntumailman16.041:2.1.20-1ubuntu0.1vulnerable
Ubuntumailman16.041:2.1.20-1ubuntu0.3vulnerable
Ubuntumailman16.041:2.1.20-1ubuntu0.4fixed
Ubuntumailman18.041:2.1.23-1vulnerable
Ubuntumailman18.041:2.1.24-1vulnerable
Ubuntumailman18.041:2.1.25-1vulnerable
Ubuntumailman18.041:2.1.26-1vulnerable
Ubuntumailman18.041:2.1.26-1ubuntu0.1fixed
Ubuntumailman20.041:2.1.29-1vulnerable
Ubuntumailman20.041:2.1.29-1build1vulnerable
Ubuntumailman20.041:2.1.29-1ubuntu3vulnerable
Ubuntumailman20.041:2.1.29-1ubuntu3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmailmandeb91:2.1.23-1+deb9u5Not reportedDSA-4664-1Not reported
Debianmailmandeb101:2.1.29-1+deb10u1Not reportedDSA-4664-1Not reported
Debianmailmandeb81:2.1.18-2+deb8u5Not reportedDLA-2200-1Not reported
Susemailmanrpmlinux enterprise point of sale 11 sp32.1.15-9.6.20.1Not reportedSUSE-SU-2020:14356-1Not reported
Susemailmanrpmlinux enterprise server 11 sp4-ltss2.1.15-9.6.20.1Not reportedSUSE-SU-2020:14356-1Not reported
Ubuntumailmandeb16.041:2.1.20-1ubuntu0.4Not reportedUBUNTU-CVE-2020-12137Not reported
Ubuntumailmandeb18.041:2.1.26-1ubuntu0.1Not reportedUBUNTU-CVE-2020-12137Not reported
Ubuntumailmandeb20.041:2.1.29-1ubuntu3.1Not reportedUBUNTU-CVE-2020-12137Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]