This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-42326 →

DEBIAN-CVE-2021-42326

Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter.

Original description

The description as published by the source.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Debian:12 redmine

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-1"}]}]

Debian:13 redmine

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-1"}]}]

Debian:14 redmine

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-1"}]}]