Redmine - Package Updates

[Package Updates]

[3.8.2]

• Update redmine to 6.0.5
• Full Changelog

[Package Updates]

[3.8.3]

• Update redmine_oauth to 3.0.4

[Package Updates]

[3.8.4]

• Update redmine_oauth to 3.0.5

[Package Updates]

[3.8.5]

• Update redmine to 6.0.6
• Full Changelog

[Package Updates]

[3.8.6]

• Update redmine_oauth to 3.0.6

[Package Updates]

[3.8.7]

• Update redmine_oauth to 3.0.7

[Package Updates]

[3.9.0]

• Update redmine to 6.1.0

[Package Updates]

[3.9.1]

• Update redmine_oauth to 3.0.8

[Package Updates]

[3.9.2]

• Update redmine to 6.1.1
• Full Changelog
• Defect #43451: PostScript disguised as PDF can lead to arbitrary file operations via thumbnail generation
• Defect #43634: Authorization bypass in Redmine allows modification of attachment metadata on invisible issues
• Defect #43635: Authorization bypass in Redmine allows deletion of attachment on invisible issues external

[Package Updates]

[3.9.3]

• Update redmine_oauth to 3.0.9

[Package Updates]

[3.10.0]

• Update redmine_oauth to 4.0.1

[Package Updates]

[3.11.0]

• Update redmine_oauth to 4.0.4

[Package Updates]

[3.11.1]

• Update redmine to 6.1.2
• Full Changelog
• Defect #43661: Unsafe eval usage in AttachmentsHelper
• Defect #43690: Directory Traversal via Backslash-Separated Paths in Filesystem SCM
• Defect #43691: DOM (Stored) XSS in @mention autocomplete via unescaped user name
• Defect #43692: LDAP Injection (Unescaped Input in LDAP Search Filter)
• Defect #43694: DOM XSS: HTML Injection via Custom Field Name in Query Filter Generation
• Defect #43830: User who is allowed to view only their own time entries can retrieve other users’ time entry details by directly specifying the TimeEntry ID via the REST API
• Defect #43864 / #43840: Update Nokogiri to 1.18.9 (5.1.12) or 1.19.1 (6.1.2 and 6.0.9).