567832 – (CVE-2015-8473) www-apps/redmine: Issues API may disclose changeset messages that are not visible

Bug 567832 (CVE-2015-8473) - www-apps/redmine: Issues API may disclose changeset messages that are not visible

Summary: www-apps/redmine: Issues API may disclose changeset messages that are not vis...

Status:	RESOLVED FIXED

Alias:	CVE-2015-8473

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal trivial (vote)
Assignee:	Gentoo Security

URL:	http://www.openwall.com/lists/oss-sec...
Whiteboard:	~4 [noglsa]
Keywords:

Depends on:
Blocks:

Reported:	2015-12-09 11:07 UTC by Agostino Sarubbo
Modified:	2016-01-23 13:16 UTC (History)
CC List:	2 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Agostino Sarubbo gentoo-dev

2015-12-09 11:07:17 UTC

From ${URL} :

Hi,

please assign a CVE ID for another information disclosure issue fixed
in the latest Redmine releases (2.6.8, 3.0.6 and 3.1.2) [1]. The bug
report [2] links to the relevant diff [3].

Cheers
Matthias

[1] <http://www.redmine.org/projects/redmine/wiki/Changelog>
[2] <https://www.redmine.org/issues/21136>
[3]
<http://www.redmine.org/projects/redmine/repository/revisions/14794/diff/trunk/app/views/issues/show.api.rsb?utf8=%E2%9C%93&type=sbs>



@maintainer(s): since the package or the affected version has never been marked as stable, we don't need to stabilize it. After the bump, please remove the affected versions from the tree.

Comment 1 Manuel Rüger (RETIRED) gentoo-dev

2016-01-17 16:46:24 UTC

Version 2.6.9 added.

Comment 2 Manuel Rüger (RETIRED) gentoo-dev

2016-01-23 13:16:45 UTC

Vulnerable version removed. Closing as NOGLSA.