[ASA-202105-1] redmine: multiple issues

🗓️ 19 May 2021 00:00:00Reported by ArchLinuxType

archlinux🔗 security.archlinux.org👁 197 Views

Redmine package version 4.2.1-1 fixes critical security vulnerabilities including arbitrary filesystem access, access restriction bypass, cross-site scripting, arbitrary file upload, and information disclosure

Reporter	Title	Published	Views	Family All 116
BDU FSTEC	The vulnerability of Redmine’s project and task management web application regarding information disclosure allows attackers to gain access to confidential data.	27 Oct 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability in the Redmine project and task management web application, related to improper authorization, allows a perpetrator to compromise data integrity.	29 Oct 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the incoming email processor in Redmine’s project and task management web application, related to improper authorization, allows a hacker to compromise data integrity.	29 Oct 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability in integrating with the Git repository for Redmine’s project and task management web applications stems from insufficient validation of input data. This allows a hacker to gain access to confidential information.	29 Oct 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the SysController and MailHandlerController components of the Redmine project and task management web application, related to the disclosure of information due to incompatibility, allows a hacker to gain access to confidential data.	2 Nov 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability in the Redmine project and task management web application, related to permission handling errors, allows a violator to access confidential data, compromise its integrity, and cause service interruptions.	14 Nov 202300:00	–	bdu_fstec
CNNVD	Redmine 跨站脚本漏洞	29 Mar 202100:00	–	cnnvd
CNNVD	Redmine 信息泄露漏洞	28 Apr 202100:00	–	cnnvd
CNNVD	Redmine 安全特征问题漏洞	28 Apr 202100:00	–	cnnvd
CNNVD	Redmine 安全特征问题漏洞	28 Apr 202100:00	–	cnnvd

OS	OS Version	Architecture	Package	Package Version	Filename
Arch Linux	–	any	redmine	4.2.1-1	redmine-4.2.1-1-any.pkg.tar.zst

Source	Link
security	www.security.archlinux.org/AVG-1743
bugs	www.bugs.archlinux.org/task/70203
redmine	www.redmine.org/projects/redmine/wiki/Security_Advisories
redmine	www.redmine.org/issues/33846
github	www.github.com/redmine/redmine/commit/bbfade972865e78e4d865af2cdb93e6cb57d5a45
redmine	www.redmine.org/issues/33360
github	www.github.com/redmine/redmine/commit/0d96c4ebdb1cceeb6cac8f940a11b5407a0a5211
redmine	www.redmine.org/issues/33689
github	www.github.com/redmine/redmine/commit/a7b9fa99966e8d59bd88548248ab11400ea48e5e
redmine	www.redmine.org/issues/35085

19 May 2021 00:00Current

1.3Low risk

Vulners AI Score1.3

CVSS 27.5

CVSS 3.19.8

EPSS0.01737