Project

General

Profile

Redmine 6.1.3, 6.0.10 and 5.1.13 released

Added by Marius BĂLTEANU about 19 hours ago

New maintenance releases for the Redmine 6.1, 6.0, and 5.1 series are now available to Download. These releases address multiple security vulnerabilities along with various bug fixes and improvements.

Security Fixes:
All three versions (6.1.3, 6.0.10, and 5.1.13) include the following security fixes:
  • Defect #43951: Bulk attachment download bypasses View files permission for project/version attachments
  • Defect #44109: PreAuth leak name of private Projects
  • Defect #44118: Any project member with add_issue_notes permission can add notes to private issues they cannot view, via the MailHandler reply dispatch
  • Defect #44138: Stored XSS in Textile formatter due to restore_redmine_links
  • Defect #44145: PostScript execution in Redmine::Thumbnail.generate via %% DSC-comment prefix
  • Defect #44146: Time-entry API hidden custom-field leak
Versions 6.1.3 and 6.0.10 also include:
  • Patch #43986: Improve the config.filter_parameters setting
Version 6.1.3 also includes:
  • Defect #44174: OAuth scope enforcement bypass in user account

You can find the new versions in the Download section. For a complete list of changes, please review the detailed Changelog for each version.

Many thanks to all the contributors who helped with these releases, especially those who responsibly reported the vulnerabilities and to Holger Just, Jens Krämer, and to Go MAEDA for their continuous work on these security issues.


Comments

Added by Holger Just about 17 hours ago

Thanks to all contributors for helping to improve Redmine's security!

As always, Planio has updated the Redmine Security Scanner with these new versions. You can subscribe for a regular scan to get an email update whenever the security status of your Redmine changes.