[Mailman-Users] Shellshock status

[Mark Sapiro]

On 10/06/2014 08:24 AM, argybard at openmailbox.org wrote:
> 
> Has there been an official word as to whether Mailman has been affected
> by the recent bash bugs, aka shellshock
> 
> Mailman is listed here https://github.com/mubix/shellshocker-pocs and I
> wonder what developers think?


Mailman's CGIs (Mailman 2.1.x at least) do not invoke bash or any shell.
The CGI wrappers use the C execve function to call python directly to
run python scripts.

The Web UI in Mailman 3 is totally different and uses Django.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan