We received the following report via vendor-sec.
The issue is public.

The improved fix is CVE-2008-0564

From the surrounding discussion I somehow got the impression that this is not severe enough to justify an online update.

Date: Mon, 04 Feb 2008 15:09:03 -0800
From: Mark Sapiro <mark@msapiro.net>
To: Jonathan Smith <smithj@freethemallocs.com>,
	Moritz Naumann <security@moritz-naumann.com>
Subject: Re: Re: [vendor-sec] mailman 2.1.10b3 fixes security issues?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Jonathan Smith wrote:
| Jonathan Smith wrote:
|> According to
|>
http://mail.python.org/pipermail/mailman-announce/2008-February/000096.htm
|> , version 2.1.10b3, a beta release, "enhances" the fix for
|> CVE-2006-3636. The announcement isn't very clear on which
|> "enhancements" are made, except that some XSS attacks are now
|> detected. Were they not previously? If the previous fix did not
|> completely eliminate the security issue, a new CVE should be obtained
|> and used to prevent this sort of confusion.
|>
|> Any information you can provide on these changes would be appreciated,
|> especially a patch which could be applied to older versions.
|
| Er, sorry, that URL should be
|
http://mail.python.org/pipermail/mailman-announce/2008-February/000096.html


The attached p1.txt is a patch that should apply to Mailman 2.1.9 with
perhaps some offset.

By way of clarification, Mailman allows a list admin to enter an HTML
fragment in the list's info attribute to be rendered as part of the
list's specific listinfo page. It also allows a list admin to edit some
HTML templates for other list specific web pages.

The original fix for CVE-2006-3636 improved the recognition and escaping
of <script> tags entered in the info attribute and edited HTML. It also
closed a number of other potential exploits having to do with specially
crafted URLs or entry of specially crafted data in fields on various
mailman web forms.

The current 2.1.10b1 and 2.1.10b3 enhancement addresses potentially
malicious HTML that might be entered in the info attribute or edited
templates. It goes beyond recognizing and escaping <script> tags. It
disallows any update matching a large set of tags and script and action
keywords that might potentially be misused.

The original CVE was obtained by Moritz Naumann (addressed on this mail)
who also gave much welcome advice used in developing the current
enhancement.

I confess, I am not really a security guy. Perhaps Moritz can obtain a
new CVE for this enhancement.

- --
Mark Sapiro <mark@msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iD8DBQFHp5sOVVuXXpU7hpMRAvzQAJ4+FnPqwJdsg9AjNxug5mM7L2ofUgCgk3r2
M9j90lTmNglRecsuvIqF3ZU=
=8ARS
-----END PGP SIGNATURE-----