Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Mailman 2.1.5 on Ubuntu reveals list membership

CVE-2005-0080 · published 21 years ago
Summary

The Mailman 2.1.5 package shipped with Ubuntu 4.10 shows different error messages when an email address is or isn’t subscribed to a private mailing list. This lets anyone who can query the service learn whether a particular address is on that list. Apply the latest security update or patch for Mailman and configure it to return the same generic response for all requests.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
gnu mailman 2.1.5
cpe:2.3:a:gnu:mailman:2.1.5:*:*:*:*:*:*:*
ubuntu ubuntu_linux 4.10
cpe:2.3:o:ubuntu:ubuntu_linux:4.10:*:*:*:*:*:*:*
Original advisory text
The 55_options_traceback.dpatch patch for mailman 2.1.5 in Ubuntu 4.10 displays a different error message depending on whether the e-mail address is subscribed to a private list, which allows remot...
The 55_options_traceback.dpatch patch for mailman 2.1.5 in Ubuntu 4.10 displays a different error message depending on whether the e-mail address is subscribed to a private list, which allows remote attackers to determine the list membership for a given e-mail address.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
1% chance of attack within 30 days
Timeline
Published2 May 2005
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2005-0080 · NVD
Track software like this
Free during beta