项目

一般

简介

Redmine 6.1.3, 6.0.10 and 5.1.13 released

由 BĂLTEANU Marius 在 7 天 之前添加

New maintenance releases for the Redmine 6.1, 6.0, and 5.1 series are now available to Download . These releases address multiple security vulnerabilities along with various bug fixes and improvements.

Security Fixes:
All three versions (version:6.1.3, version:6.0.10, and version:5.1.13) include the following security fixes:
  • Defect #43951: Bulk attachment download bypasses View files permission for project/version attachments
  • Defect #44109: PreAuth leak name of private Projects
  • Defect #44118: Any project member with add_issue_notes permission can add notes to private issues they cannot view, via the MailHandler reply dispatch
  • Defect #44138: Stored XSS in Textile formatter due to restore_redmine_links
  • Defect #44145: PostScript execution in Redmine::Thumbnail.generate via %% DSC-comment prefix
  • Defect #44146: Time-entry API hidden custom-field leak
Versions version:6.1.3 and version:6.0.10 also include:
  • Patch #43986: Improve the config.filter_parameters setting
Version version:6.1.3 also includes:
  • Defect #44174: OAuth scope enforcement bypass in user account

You can find the new versions in the Download section. For a complete list of changes, please review the detailed Changelog for each version.

Many thanks to all the contributors who helped with these releases, especially those who responsibly reported the vulnerabilities and to user:hjust, user:jkraemer, and to user:maeda for their continuous work on these security issues.


评论

由 Just Holger 在 7 天 之前添加

Thanks to all contributors for helping to improve Redmine’s security!

As always, Planio has updated the Redmine Security Scanner with these new versions. You can subscribe for a regular scan to get an email update whenever the security status of your Redmine changes.

点赞0