CVE-2006-4624

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-09-07 · updated 2026-06-16
Weakness: CWE-94

Description

CRLF injection vulnerability in Utils.py in Mailman before 2.1.9rc1 allows remote attackers to spoof messages in the error log and possibly trick the administrator into visiting malicious URLs via CRLF sequences in the URI.

Affected products

GNU Mailman: through 2.1.8

References

http://mail.python.org/pipermail/mailman-announce/2006-September/000087.html
http://moritz-naumann.com/adv/0013/mailmanmulti/0013.txt
http://secunia.com/advisories/21732
http://secunia.com/advisories/22011
http://secunia.com/advisories/22020
http://secunia.com/advisories/22227
http://secunia.com/advisories/22639
http://secunia.com/advisories/27669
http://security.gentoo.org/glsa/glsa-200609-12.xml
http://sourceforge.net/project/shownotes.php?group_id=103&release_id=444295
http://svn.sourceforge.net/viewvc/mailman/trunk/mailman/Mailman/Utils.py?r1=7859&r2=7923
http://www.debian.org/security/2006/dsa-1188

Get alerted when CVE-2006-4624 or the next vulnerability affects your stack