git: f05ee16987d1 - main - mail/mailman: security update to 2.1.37

The branch main has been updated by mandree:

URL: https://cgit.FreeBSD.org/ports/commit/?id=f05ee16987d1bf5d7002e939614f853d99286fe7

commit f05ee16987d1bf5d7002e939614f853d99286fe7
Author:     Matthias Andree <mandree@FreeBSD.org>
AuthorDate: 2021-11-13 10:27:55 +0000
Commit:     Matthias Andree <mandree@FreeBSD.org>
CommitDate: 2021-11-13 10:27:55 +0000

    mail/mailman: security update to 2.1.37
    
    - A potential XSS attack via the user options page has been reported by
      Harsh Jaiswal.  This is fixed.  CVE-2021-43331 (LP: #1949401)
    
    LP: A crafted URL to the user options page can execute arbitrary
        javascript.
    
    - A potential for for a list moderator to carry out an off-line brute force
      attack to obtain the list admin password has been reported by Andre
      Protas, Richard Cloke and Andy Nuttall of Apple.  This is fixed.
      CVE-2021-43332 (LP: #1949403)
    
    LP: The CSRF token for the admindb page contains an encrypted version of
        the list admin password which could potentially be cracked by a
        moderator via an off-line brute force attack.
    
    MFH:            2021Q4
    Security:       9d7a2b54-4468-11ec-8532-0d24c37c72c8
    Security:       CVE-2021-43331
    Security:       CVE-2021-43332
---
 mail/mailman/Makefile | 2 +-
 mail/mailman/distinfo | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/mail/mailman/Makefile b/mail/mailman/Makefile
index a5a447104393..8250bc733ec6 100644
--- a/mail/mailman/Makefile
+++ b/mail/mailman/Makefile
@@ -1,7 +1,7 @@
 # Created by: n_hibma@qubesoft.com
 
 PORTNAME=	mailman
-DISTVERSION=	2.1.35
+DISTVERSION=	2.1.37
 CATEGORIES=	mail
 MASTER_SITES=	GNU \
 		SF/${PORTNAME}/Mailman%202.1%20%28stable%29/${PORTVERSION} \
diff --git a/mail/mailman/distinfo b/mail/mailman/distinfo
index 1972fab47297..b7eb6f32f810 100644
--- a/mail/mailman/distinfo
+++ b/mail/mailman/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1634751988
-SHA256 (mailman/mailman-2.1.35.tgz) = 4ac4d29648144049ef9fa5b1ecd5441b5bd5373111f200c933ebe5c589ba46bf
-SIZE (mailman/mailman-2.1.35.tgz) = 9508348
+TIMESTAMP = 1636797368
+SHA256 (mailman/mailman-2.1.37.tgz) = 689ff350857728ccc4ed379ceef54b93f710af8740cabc3bfe0348173b6b3f4f
+SIZE (mailman/mailman-2.1.37.tgz) = 9508379
 SHA256 (mailman/msapiro-htdig-1822.patch.xz) = fa1da6fb7c0946a6723bc2766501c222fa73c8d794566a3b6e5718a7d1840265
 SIZE (mailman/msapiro-htdig-1822.patch.xz) = 50700