Redmine 4.2.7 and 5.0.2
Redmine version:“4.2.7” and version:“5.0.2” have been released and are available for [[download]], you can review the changes in the [[Changelog]].
These maintenance releases fixes some important issues and multiple security fixes that were found in the latest Redmine 4.2.* and 5.0.* versions.
Security:- Updates commonmark gem version to 0.23.4 when Ruby >= 2.6 is used in order to fix a remote code execution vulnerability. Because the fixed version of the gem doesn’t support Ruby 2.5, those instances that are using Redmine 5.0.*, Commonmark and Ruby 2.5, it is highly recommended to update Ruby version to at least 2.6 because it’s the only way to get the update and the fix. Also, the next major Redmine version (version:“5.1.0”) already dropped support for Ruby 2.5 (#37159).
- Updates jQuery UI to 1.31.1 to fix 3 medium severity XSS vulnerabilities
- Fixes unauthorised Information Leak in QueryAssociationColumn and QueryAssociationCustomFieldColumn when the user has no permission to view on the associated object
Many thanks to Liane Hampe and Felix Schäfer for reporting these security issues and to Holger Just and Felix Schäfer for their work on fixing all these issues.
点赞0
评论
由 E Erik 在 超过 2 年 之前添加
Thanks to all contributors!
由 Zucchi Alessandro 在 超过 2 年 之前添加
Greats!
Thank you all for your efforts!
As always, we have updated the Redmine Security Scanner to fully recognize the new versions. Feel free to subscribe for a regular scan to get email updates whenever the security status of your Redmine changes.
由 Hampe Liane 在 超过 2 年 之前添加
Many thanks to the Redmine core contributor team for implementing especially the security fixes so quickly! 😊
由 Darksidds Darksidds 在 超过 2 年 之前添加
Thanks!
由 Sar Hiwe 在 超过 2 年 之前添加
Viva la Redmine Community! Thank you all