CVE-2020-15011: 
NixOS vulnerability analysis and mitigation

CVE-2020-15011 affects GNU Mailman versions before 2.1.33, where the vulnerability allows arbitrary content injection via the Cgi/private.py private archive login page (NVD, CVE). The vulnerability was discovered and disclosed in June 2020.

The vulnerability has a CVSS v3.1 Base Score of 4.3 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The attack vector is through the private archive login page, and the vulnerability is classified as CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (NVD).

An attacker could potentially inject arbitrary content into the login page if they send specially crafted input. The vulnerability only succeeds if the list's roster visibility (private_roster) setting is 'Anyone' (Launchpad Bug).

The vulnerability requires network access and user interaction, but no privileges or authentication. The attack complexity is rated as low, indicating relatively straightforward exploitation (NVD).

The vulnerability was fixed in GNU Mailman version 2.1.33. Various Linux distributions have released security updates to address this issue: Ubuntu (versions 1:2.1.26-1ubuntu0.3 for 18.04 and 1:2.1.20-1ubuntu0.6 for 16.04), Debian (version 1:2.1.29-1+deb10u2 for Buster), and Red Hat Enterprise Linux 8 (version 2.1.29-11.module+el8.4.0+8277+5e2c6e6e) (Ubuntu Notice, Debian Notice, Red Hat Advisory).