Redmine 2.2.1, 2.1.6 and 1.4.6 security releases

Added by Jean-Philippe Lang over 1 year ago

Several security vulnerabilities have been discovered in Ruby on Rails lately (read the announcement) and are fixed in all of these new Redmine releases. These vulnerabilities are considered critical, so upgrading as soon as possible is highly recommended.

These new releases are available at Rubyforge.


Comments

Added by Deoren Moor over 1 year ago

Thanks!

Added by Marcello Lussana over 1 year ago

Thanks!
How can I get Info about this kind of release? Is there a newsletter or an Issue to follow?

Best

Added by brian veltman over 1 year ago

http://www.redmine.org/projects/redmine/news at the bottom of the page click "atom" =)

Added by Denial Dester over 1 year ago

Thank you!

What about redmine version 2.0.4 ?
Does it vulnerable too?
Thanks.

Added by Jakob Skjerning over 1 year ago

Denial Dester, yes. All versions prior to the ones just released are vulnerable.

Added by Lukas Elmer over 1 year ago

Great response time, very nice, thanks!

Added by Dietmar H over 1 year ago

Can you tell me if this vulnerability is relevant for me if access to Redmine is restricted to registered users (no autonomous registration possible) and if this users are trusted?

Added by Jean-Philippe Lang over 1 year ago

As far as I know, it should be OK for you if untrusted users have access to the login form only. Upgrading is still the best option.

Added by Dietmar H over 1 year ago

ok, thx

Added by Florian S. over 1 year ago

Thank you for your fast response time and your software - update worked fine