From 4a84416248d74a44369dfa5c4a1b240256539023 Mon Sep 17 00:00:00 2001
From: starlet-dx <15929766099@163.com>
Date: Sat, 4 Dec 2021 16:51:47 +0800
Subject: [PATCH] Fix CVE-2021-44227

(cherry picked from commit 14335a3625ca066938e32eb91aad79cc88aa75ef)
---
 CVE-2021-44227.patch | 85 ++++++++++++++++++++++++++++++++++++++++++++
 mailman.spec         |  6 +++-
 2 files changed, 90 insertions(+), 1 deletion(-)
 create mode 100644 CVE-2021-44227.patch

diff --git a/CVE-2021-44227.patch b/CVE-2021-44227.patch
new file mode 100644
index 0000000..8b10d5a
--- /dev/null
+++ b/CVE-2021-44227.patch
@@ -0,0 +1,85 @@
+diff --git a/Mailman/CSRFcheck.py b/Mailman/CSRFcheck.py
+index 24e3e11..81998cf 100644
+--- a/Mailman/CSRFcheck.py
++++ b/Mailman/CSRFcheck.py
+@@ -55,7 +55,7 @@ def csrf_token(mlist, contexts, user=None):
+     token = binascii.hexlify(marshal.dumps((issued, keymac)))
+     return token
+ 
+-def csrf_check(mlist, token, options_user=None):
++def csrf_check(mlist, token, cgi_user=None):
+     """ check token by mailman cookie validation algorithm """
+     try:
+         issued, keymac = marshal.loads(binascii.unhexlify(token))
+@@ -67,12 +67,25 @@ def csrf_check(mlist, token, options_user=None):
+             key, user = key.split('+', 1)
+         else:
+             user = None
++        # Don't allow unprivileged tokens for admin or admindb.
++        if cgi_user == 'admin':
++            if key not in ('admin', 'site'):
++                syslog('mischief',
++                       'admin form submitted with CSRF token issued for %s.',
++                       key + '+' + user if user else key)
++                return False
++        elif cgi_user == 'admindb':
++            if key not in ('moderator', 'admin', 'site'):
++                syslog('mischief',
++                       'admindb form submitted with CSRF token issued for %s.',
++                       key + '+' + user if user else key)
++                return False
+         if user:
+             # This is for CVE-2021-42097.  The token is a user token because
+             # of the fix for CVE-2021-42096 but it must match the user for
+             # whom the options page is requested.
+             raw_user = UnobscureEmail(urllib.unquote(user))
+-            if options_user and options_user != raw_user:
++            if cgi_user and cgi_user != raw_user:
+                 syslog('mischief',
+                        'Form for user %s submitted with CSRF token '
+                        'issued for %s.',
+diff --git a/Mailman/Cgi/admin.py b/Mailman/Cgi/admin.py
+index b5f1482..a25d7e7 100644
+--- a/Mailman/Cgi/admin.py
++++ b/Mailman/Cgi/admin.py
+@@ -107,7 +107,8 @@ def main():
+                    'legend']
+     params = cgidata.keys()
+     if set(params) - set(safe_params):
+-        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
++        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
++                                  'admin')
+     else:
+         csrf_checked = True
+     # if password is present, void cookie to force password authentication.
+diff --git a/Mailman/Cgi/admindb.py b/Mailman/Cgi/admindb.py
+index 32b0be7..640cd0e 100644
+--- a/Mailman/Cgi/admindb.py
++++ b/Mailman/Cgi/admindb.py
+@@ -143,7 +143,8 @@ def main():
+     safe_params = ['adminpw', 'admlogin', 'msgid', 'sender', 'details']
+     params = cgidata.keys()
+     if set(params) - set(safe_params):
+-        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
++        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
++                                  'admindb')
+     else:
+         csrf_checked = True
+     # if password is present, void cookie to force password authentication.
+diff --git a/Mailman/Cgi/edithtml.py b/Mailman/Cgi/edithtml.py
+index 1dd9e87..170e811 100644
+--- a/Mailman/Cgi/edithtml.py
++++ b/Mailman/Cgi/edithtml.py
+@@ -111,7 +111,8 @@ def main():
+     safe_params = ['VARHELP', 'adminpw', 'admlogin']
+     params = cgidata.keys()
+     if set(params) - set(safe_params):
+-        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'))
++        csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'),
++                                  'admin')
+     else:
+         csrf_checked = True
+     # if password is present, void cookie to force password authentication.
+-- 
+2.27.0
+
diff --git a/mailman.spec b/mailman.spec
index a4cbb0d..b0b45f8 100644
--- a/mailman.spec
+++ b/mailman.spec
@@ -3,7 +3,7 @@
 
 Name:           mailman
 Version:        2.1.36
-Release:        1
+Release:        2
 Epoch:          3
 Summary:        GNU Mailing List Manager
 License:        GPLv2+
@@ -27,6 +27,7 @@ Patch7:         mailman-2.1.13-archive-reply.patch
 Patch13:        mailman-2.1.9-unicode.patch
 Patch21:        mailman-2.1.13-env-python.patch
 Patch22:        mailman-2.1.15-check_perms.patch
+Patch23:        CVE-2021-44227.patch
 
 BuildRequires:  automake gcc python2-devel systemd python2-dns
 Requires(pre):  shadow-utils
@@ -421,6 +422,9 @@ exit 0
 %dir %attr(775,root,%{name}) /var/lock/%{name}
 
 %changelog
+* Sat Dec 4 2021 yaoxin <yaoxin30@huawei.com> - 2.1.36-2
+- Fix CVE-2021-44227
+
 * Thu Nov 18 2021 houyingchao <houyingchao@huawei.com> - 2.1.36-1
 - Upgrade to 2.1.36
 - Fix CVE-2021-43332 CVE-2021-43331
-- 
Gitee