Redmine

New maintenance releases for the Redmine 7.0, 6.1, and 6.0 series are now available to Download, addressing security vulnerabilities along with various bug fixes and improvements.

Considering the general increase in security vulnerabilities being discovered and reported across software projects these days, we have decided to also release updates for the third branch (legacy stable, currently 6.0.x) whenever High or Critical severity vulnerabilities are fixed.

Security Fixes
All three versions (7.0.3, 6.1.6, and 6.0.12) include:

• Defect #44657: ReDoS in wiki macro argument parsing
• Defect #44682: Reflected XSS in attachments#edit_all (unvalidated back_url)
• Defect #44683: validate_back_url accepts URLs that browsers resolve to another host

Versions 7.0.3 and 6.1.6 also include:

• Defect #44625: OAuth token scope is ignored in Project.allowed_to_condition
• Defect #44644: OAuth token scopes are bypassed when creating projects

Version 6.0.12 also includes two security fixes previously released in 7.0.2 and 6.1.5:

• Defect #44467: Private/invisible issue subjects leaked via REST API include=children
• Defect #44468: Private project names and role assignments leaked via GET /groups/<id>.json?include=memberships

Key Improvements and Fixes

• Accounts & Authentication: Invalidated sessions and autologin tokens when an email address is changed or deleted (#44578), prevented reusing an expired password via "Lost password" (#44673), fixed a 500 error on OAuth API requests for inactive users (#44654), and removed leftover development hosts from the OAuth redirect URI HTTPS exemption (#44653).
• Attachments & Wiki (7.0.3): Fixed serving partially written thumbnails during generation or after a failure (#44620), fixed leftover Ghostscript processes when PDF thumbnail generation times out (#44624, missing merge of #44378 in 7.0.2), and fixed faulty "Edit this section" links added by the include() macro (#44623).
• Issues, Time Tracking & Notifications: Fixed auto-watch not adding the assignee as a watcher on issue creation (#44680 in 7.0.3), preserved hidden custom field values when time entries are edited by users without field visibility (#44610), fixed attachment ordering in issue history on PostgreSQL (#44579), and resolved notification errors when bulk deleting parent/subtask issues (#44650).
• UI, Gantt & Calendar: Fixed Gantt expand/collapse icons for projects with only subprojects (#44694) and mobile column resize handles (#44611 in 7.0.3), improved visual distinction of version start/due dates in the calendar (#44643), added width and height attributes to Gravatar images (#44645), and fixed cross-project news preview 404 errors (#44361).
• SCM, Themes & Performance: Fixed Mercurial 7.2+ compatibility (#44231), fixed automatic asset precompilation when new asset files have older mtimes than the manifest (#44240), and backported the fix for browser freezes on pages with thousands of sortable items to 6.1.6 (#44372).

Download and Changelog: Find the new packages in the Download section, see the full list of changes in the Changelog and the updated Security Advisories.

Many thanks to all contributors and security researchers who helped with these releases.