Bug 817917 (CVE-2021-42326)

Summary:	<www-apps/redmine-{4.1.5,4.2.3}: insufficient access filter (CVE-2021-42326)
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	trivial	CC:	azamat.hackimov, proxy-maint, sam
Priority:	Normal	Keywords:	PullRequest
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://www.redmine.org/projects/redmine/wiki/Security_Advisories
See Also:	https://github.com/gentoo/gentoo/pull/22587
Whiteboard:	~4 [noglsa]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2021-10-13 01:57:41 UTC

CVE-2021-42326:

Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter.

Please bump.

Comment 1 Sam James archtester

2021-10-13 01:59:03 UTC

*** Bug 817686 has been marked as a duplicate of this bug. ***

Comment 2 Larry the Git Cow gentoo-dev

2021-10-20 01:14:29 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ba994378b56d87b15c84344466dae648484bd0d3

commit ba994378b56d87b15c84344466dae648484bd0d3
Author:     Azamat H. Hackimov <azamat.hackimov@gmail.com>
AuthorDate: 2021-10-15 11:51:05 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2021-10-20 01:11:38 +0000

    www-apps/redmine: new versions 4.1.5 and 4.2.3
    
    Fix security issue CVE-2021-42326
    Bug: https://bugs.gentoo.org/817917
    Package-Manager: Portage-3.0.20, Repoman-3.0.3
    Signed-off-by: Azamat H. Hackimov <azamat.hackimov@gmail.com>
    Signed-off-by: Sam James <sam@gentoo.org>

 www-apps/redmine/Manifest             |   2 +
 www-apps/redmine/redmine-4.1.5.ebuild | 233 +++++++++++++++++++++++++++++++++
 www-apps/redmine/redmine-4.2.3.ebuild | 240 ++++++++++++++++++++++++++++++++++
 3 files changed, 475 insertions(+)

Comment 3 John Helmert III archtester

2021-10-20 14:37:48 UTC

Thanks, all done!