New maintenance releases for the Redmine 6.1, 6.0, and 5.1 series are now available to Download. These releases address multiple security vulnerabilities along with various bug fixes and improvements.
Security Fixes:
All three versions (6.1.3, 6.0.10, and 5.1.13) include the following security fixes:
- Defect #43951: Bulk attachment download bypasses View files permission for project/version attachments
- Defect #44109: PreAuth leak name of private Projects
- Defect #44118: Any project member with
add_issue_notes permission can add notes to private issues they cannot view, via the MailHandler reply dispatch
- Defect #44138: Stored XSS in Textile formatter due to
restore_redmine_links
- Defect #44145: PostScript execution in
Redmine::Thumbnail.generate via %% DSC-comment prefix
- Defect #44146: Time-entry API hidden custom-field leak
Versions 6.1.3 and 6.0.10 also include:
- Patch #43986: Improve the
config.filter_parameters setting
Version 6.1.3 also includes:
- Defect #44174: OAuth scope enforcement bypass in user account
You can find the new versions in the Download section. For a complete list of changes, please review the detailed Changelog for each version.
Many thanks to all the contributors who helped with these releases, especially those who responsibly reported the vulnerabilities and to Holger Just, Jens Krämer, and to Go MAEDA for their continuous work on these security issues.
https://www.redmine.org/news/160
New maintenance releases for the Redmine 6.1, 6.0, and 5.1 series are now available to Download. These releases address multiple security vulnerabilities along with various bug fixes and improvements.
Security Fixes:
All three versions (6.1.3, 6.0.10, and 5.1.13) include the following security fixes:
add_issue_notespermission can add notes to private issues they cannot view, via the MailHandler reply dispatchrestore_redmine_linksRedmine::Thumbnail.generatevia%% DSC-commentprefixVersions 6.1.3 and 6.0.10 also include:
config.filter_parameterssettingVersion 6.1.3 also includes:
You can find the new versions in the Download section. For a complete list of changes, please review the detailed Changelog for each version.
Many thanks to all the contributors who helped with these releases, especially those who responsibly reported the vulnerabilities and to Holger Just, Jens Krämer, and to Go MAEDA for their continuous work on these security issues.
https://www.redmine.org/news/160