Skip to content

Send archiver key as a HTTP header (CVE-2021-35058)

legoktm requested to merge legoktm/mailman-hyperkitty:archiver-key into master

Passing the archiver key as a GET query parameter means it shows up in various uwsgi/server logs. Instead, send it as a HTTP header which should keep it out of all logs.

This will require updating your hyperkitty package to read the key from the header. See hyperkitty!354 (merged).

Fixes hyperkitty#387 (closed)

Merge request reports