Redmine插件中文站

New maintenance releases for the Redmine 6.1, 6.0, and 5.1 series are now available to Download . These releases address multiple security vulnerabilities along with various bug fixes and improvements.

Security Fixes:
All three versions (version:6.1.3, version:6.0.10, and version:5.1.13) include the following security fixes:

• Defect #43951: Bulk attachment download bypasses View files permission for project/version attachments
• Defect #44109: PreAuth leak name of private Projects
• Defect #44118: Any project member with add_issue_notes permission can add notes to private issues they cannot view, via the MailHandler reply dispatch
• Defect #44138: Stored XSS in Textile formatter due to restore_redmine_links
• Defect #44145: PostScript execution in Redmine::Thumbnail.generate via %% DSC-comment prefix
• Defect #44146: Time-entry API hidden custom-field leak

Versions version:6.1.3 and version:6.0.10 also include:

• Patch #43986: Improve the config.filter_parameters setting

Version version:6.1.3 also includes:

• Defect #44174: OAuth scope enforcement bypass in user account

You can find the new versions in the Download section. For a complete list of changes, please review the detailed Changelog for each version.

Many thanks to all the contributors who helped with these releases, especially those who responsibly reported the vulnerabilities and to user:hjust, user:jkraemer, and to user:maeda for their continuous work on these security issues.