Project

General

Profile

Redmine 7.0.1, 6.1.4 and 6.0.11 released

Added by Marius BĂLTEANU about 10 hours ago

New maintenance releases for the Redmine 7.0, 6.1, and 6.0 series are now available to Download. These releases address multiple security vulnerabilities along with various bug fixes and improvements.

Security Fixes

All three versions (7.0.1, 6.1.4, and 6.0.11) include the following security fixes:
  • Defect #44249: API requests can affect a user's session and circumvent security policies
  • Defect #44308: Stored XSS in Redmine Textile Formatter via < notextile > Tag-Restoration ("Frankenstein tag")
  • Defect #44309: Nested issue-relations endpoints bypass source issue visibility
  • Defect #44310: Child project inherit_members updates bypass member-management authorization
  • Patch #44371: Filter key parameter from logging

Maintenance Improvements

Redmine 7.0.1 is the first maintenance release for Redmine 7.0 and includes numerous fixes and improvements, notably:
  • Rails Support : Rails updated to 8.1.3.1 (7.0.1) and 7.2.3.2 (6.1.4 and 6.0.11).
  • Performance : Resolved a text formatting performance regression when containers have many attachments (#44348).
  • Third-party libraries : Broken charts In Repository Statistics
  • REST API : Added project information to the wiki page list API response (#44353).
  • Authentication & Administration: Fixed user deletion when OAuth2 applications are authorized (#44343), prevented browsers from autofilling administrator passwords into user account forms (#44268), and fixed lost password access for 2FA-enforced admins (#44360).
  • UI & Usability: Fixed journal `#note-N` link shifting upon deletion (#44258), Classic theme top menu positioning (#44351), wide tab bar wrapping issues (#44318), improved the highlight of the top menu (#44341), and the style of the newly account menu (#44293).

Download and Changelog

You can find the new versions in the Download section. For a complete list of changes, please review the detailed Changelog for each version.

Many thanks to all the contributors who helped with these releases, especially those who responsibly reported the vulnerabilities and helped resolve them.


Comments