This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2021-31866 →
DEBIAN-CVE-2021-31866
Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing differences in...
Original description
The description as published by the source.
Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing differences in string comparison operations within SysController and MailHandlerController.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
redmine
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-1"}]}]
Debian:13
redmine
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-1"}]}]
Debian:14
redmine
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-1"}]}]
References
- advisory security-tracker.debian.org