We have become aware that the version of mailman as
supplied
in Debian GNU/Linux 2.1 has a problem with verifying list administrators.
The problem is that the cookie value generation used was predictable, so
using forged authentication cookies it was possible to access the list
administration webpages without knowing the proper password. More
information about this vulnerability can be found at
python.org mailman-developers list for 1999-June, in the
"Cookie security hole in admin interface" thread.
This has been fixed in version 1.0rc2-5.
