817917 – (CVE-2021-42326) <www-apps/redmine-{4.1.5,4.2.3}: insufficient access filter (CVE-2021-42326)

Bug 817917 (CVE-2021-42326) - <www-apps/redmine-{4.1.5,4.2.3}: insufficient access filter (CVE-2021-42326)

Summary: <www-apps/redmine-{4.1.5,4.2.3}: insufficient access filter (CVE-2021-42326)

Status:	RESOLVED FIXED

Alias:	CVE-2021-42326

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal trivial
Assignee:	Gentoo Security

URL:	https://www.redmine.org/projects/redm...
Whiteboard:	~4 [noglsa]
Keywords:	PullRequest

Duplicates (1):	817686 (view as bug list)
Depends on:
Blocks:

Reported:	2021-10-13 01:57 UTC by John Helmert III
Modified:	2021-10-20 14:37 UTC (History)
CC List:	3 users (show)

See Also:	https://github.com/gentoo/gentoo/pull/22587
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2021-10-13 01:57:41 UTC

CVE-2021-42326:

Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter.

Please bump.

Comment 1 Sam James archtester

2021-10-13 01:59:03 UTC

*** Bug 817686 has been marked as a duplicate of this bug. ***

Comment 2 Larry the Git Cow gentoo-dev

2021-10-20 01:14:29 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ba994378b56d87b15c84344466dae648484bd0d3

commit ba994378b56d87b15c84344466dae648484bd0d3
Author:     Azamat H. Hackimov <azamat.hackimov@gmail.com>
AuthorDate: 2021-10-15 11:51:05 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2021-10-20 01:11:38 +0000

    www-apps/redmine: new versions 4.1.5 and 4.2.3
    
    Fix security issue CVE-2021-42326
    Bug: https://bugs.gentoo.org/817917
    Package-Manager: Portage-3.0.20, Repoman-3.0.3
    Signed-off-by: Azamat H. Hackimov <azamat.hackimov@gmail.com>
    Signed-off-by: Sam James <sam@gentoo.org>

 www-apps/redmine/Manifest             |   2 +
 www-apps/redmine/redmine-4.1.5.ebuild | 233 +++++++++++++++++++++++++++++++++
 www-apps/redmine/redmine-4.2.3.ebuild | 240 ++++++++++++++++++++++++++++++++++
 3 files changed, 475 insertions(+)

Comment 3 John Helmert III archtester

2021-10-20 14:37:48 UTC

Thanks, all done!