Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 567836 - www-apps/redmine: Data disclosure in atom feed
Summary: www-apps/redmine: Data disclosure in atom feed
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial
Assignee: Gentoo Security
URL: http://www.openwall.com/lists/oss-sec...
Whiteboard: ~3 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2015-12-09 11:10 UTC by Agostino Sarubbo
Modified: 2016-01-23 13:16 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2015-12-09 11:10:22 UTC 
From ${URL} :

please assign a CVE ID a data disclosure issue fixed in the latest
Redmine Releases (2.6.9, 3.0.7 and 3.1.3) [1,2,3,4]. Changelogs are
mentioning a private ticket [5]. The relevant commit should be this
one [6].

Cheers
Matthias

[1] http://www.redmine.org/projects/redmine/wiki/Changelog_3_1
[2] http://www.redmine.org/projects/redmine/wiki/Changelog_3_0
[3] http://www.redmine.org/projects/redmine/wiki/Changelog_2_6
[4] http://www.redmine.org/news/103
[5] http://www.redmine.org/issues/21419
[6]
<https://github.com/redmine/redmine/commit/7e423fb4538247d59e01958c48b491f196a1de56>

http://www.redmine.org/projects/redmine/wiki/Security_Advisories



@maintainer(s): since the package or the affected version has never been marked as stable, we don't need to stabilize it. After the bump, please remove the affected versions from the tree.
Comment 1 Manuel Rüger (RETIRED) gentoo-dev 2016-01-17 16:46:37 UTC 
Version 2.6.9 added.
Comment 2 Manuel Rüger (RETIRED) gentoo-dev 2016-01-23 13:16:03 UTC 
Vulnerable version removed. Closing as NOGLSA.