[CPANEL-26813] Mailman 2.1.27

albatroz

• April 10, 2019 08:29

One of my customers did run a vulnerability test against my VPS and discovered that CPanel uses version 2.1.27 of Mailman stating that it is quite old and vulnerable so he is wondering if we can update it.

• 

  cPanelLauren

  • April 11, 2019 20:55

  Hi @albatroz Currently the only feasible update path is to move to mailman 3 which isn't a seamless/easy move. There is a feature request open for this though which I'd encourage you to vote on, you can find it here: Upgrade to MailMan 3.0! (or wait until 3.1 is out which supports migrating from 2.x) Thanks!

  0
• 

  rclemings

  • April 11, 2019 22:47

  Better expedite that feature. Python 2.7 (which Mailman 2.1 is built on) is EOL on Jan. 1. (Benny told me in an off-forum exchange today that: "We"re hoping to work with the Mailman folks more closely this year on ways to migrate from Mailman 2 to Mailman 3.") This thread from the Mailman 2 list may be of interest: [Mailman-Users] Now that Python 2 is dead in 2020 what are people's plans with mailman2?

  0
• 

  cPanelLauren

  • April 11, 2019 23:22

  Hi @rclemings Understood, I spoke to some of the folks on the team responsible about this today and the EoL of Python 2.7 was brought up and I'm waiting on some further feedback on this. I can update here when I get more information. I've also opened CPANEL-26813 as an internal Improvement case to address this.

  0
• 

  brianc

  • April 23, 2019 20:52

  I suspect cPanel will keep Python 2 and just backport security fixes to it as they do for some of the other "EOL" software. Upgrading Mailman 2 to version 2.1.29 should fix any security issues. I am not sure what the delay is in doing that. cPanel? Why hasn't Mailman 2 been updated to 2.1.29?

  0

Please sign in to leave a comment.