Debian Security Advisory

DSA-4191-1 redmine -- security update

Date Reported:

03 May 2018

Affected Packages:

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 882544, Bug 882545, Bug 882547, Bug 882548, Bug 887307.
In Mitre's CVE dictionary: CVE-2017-15568, CVE-2017-15569, CVE-2017-15570, CVE-2017-15571, CVE-2017-15572, CVE-2017-15573, CVE-2017-15574, CVE-2017-15575, CVE-2017-15576, CVE-2017-15577, CVE-2017-16804, CVE-2017-18026.

More information:

Multiple vulnerabilities were discovered in Redmine, a project management web application. They could lead to remote code execution, information disclosure or cross-site scripting attacks.

For the stable distribution (stretch), these problems have been fixed in version 3.3.1-4+deb9u1.

We recommend that you upgrade your redmine packages.

In addition, this message serves as an announcement that security support for redmine in the Debian 8 oldstable release (jessie) is now discontinued.

Users of redmine in Debian 8 that want security updates are strongly encouraged to upgrade now to the current Debian 9 stable release (stretch).

For the detailed security status of redmine please refer to its security tracker page at: https://security-tracker.debian.org/tracker/redmine