566794 – www-apps/redmine: information disclosure on the time logging form

Bug 566794 - www-apps/redmine: information disclosure on the time logging form

Summary: www-apps/redmine: information disclosure on the time logging form

Status:	RESOLVED FIXED

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal trivial (vote)
Assignee:	Gentoo Security

URL:	http://www.openwall.com/lists/oss-sec...
Whiteboard:	~4 [noglsa]
Keywords:

Depends on:
Blocks:

Reported:	2015-11-25 10:57 UTC by Agostino Sarubbo
Modified:	2016-01-23 13:16 UTC (History)
CC List:	2 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Agostino Sarubbo gentoo-dev

2015-11-25 10:57:55 UTC

From ${URL} :

please assign a CVE ID for an information disclosure issue in the
latest Redmine releases (2.6.8, 3.0.6 and 3.1.2) [1]. The issue is
listed at [2] and a commit can be found at [3]. A private bug report
appears to exist at [4]

Cheers
Matthias

[1] <http://www.redmine.org/news/102>
[2] <http://www.redmine.org/projects/redmine/wiki/Security_Advisories>
[3] <https://github.com/redmine/redmine/commit/c096dde88ff02872ba35edc4dc403c80a7867b5c>
[4] <https://www.redmine.org/issues/21150>


@maintainer(s): since the package or the affected version has never been marked as stable, we don't need to stabilize it. After the bump, please remove the affected versions from the tree.

Comment 1 Manuel Rüger (RETIRED) gentoo-dev

2016-01-17 16:46:20 UTC

Version 2.6.9 added.

Comment 2 Manuel Rüger (RETIRED) gentoo-dev

2016-01-23 13:16:56 UTC

Vulnerable version removed. Closing as NOGLSA.