Home » security

Tag: security

ChiliProject 2.7.4 released

ChiliProject 2.7.4 has just been released. This release is a security release to fix two XSS vulnerabilities (CVE-2012-3464CVE-2012-3465) and a SQL injection vulnerability (CVE-2012-5664) of Rails. All these bugs were fixed in Rails, we have included the fixes from Rails or backported them to the version of Rails ChiliProject uses right now.

This release contains no other bug fixes or new features and is released for users who are unable to upgrade to ChiliProject 3.4.0. It is suitable for use on production websites running ChiliProject 2.x and we highly recommend that 2.x users download and install the security release immediately.

Download ChiliProject 2.7.4

What’s included

2.7.4 includes three security fixes which were backported from ChiliProject 3.4.0.

  • Security – Bug #1113: Potential XSS Vulnerability in Ruby on Rails
  • Security – Bug #1114: XSS Vulnerability in strip_tags
  • Security – Bug #1195: SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664)

If you think you have found a security issue in ChiliProject please report it to the security team privately so we can follow responsible disclosure.

What’s Next?

The 2.x versions of ChiliProject are officially in maintenance mode and will only be getting security updates until the release of 4.0. After that date the 2.x branch is no longer supported in any way. We recommend upgrading to the current stable version of ChiliProject in order to get general bug fixes and features, currently ChiliProject 3.4.0.

ChiliProject 3.4.0 released

ChiliProject 3.4.0 has just been released. It includes lots of bug fixes for ChiliProject 3.3.0 as well as 3 security fixes. It is suitable for use on production websites and we highly recommend that all users download the release as soon as possible.

Download ChiliProject 3.4.0

What’s included

3.4.0 includes 3 security fixes for Rails as well as 11 bug fixes for 3.3.0. The security fixes fix two XSS vulnerabilities (CVE-2012-3464, CVE-2012-3465) and a SQL injection vulnerability (CVE-2012-5664) of Rails.

The full list of changes:

  • Bug #904: Copy workflow doesn’t work on per-author / per-assigned modifier
  • Bug #1087: Document category is not saved properly
  • Bug #1090: List of saved queries is not accessible outside of a project
  • Bug #1111: use a monospace font in wiki-text
  • Security – Bug #1113: Potential XSS Vulnerability in Ruby on Rails
  • Security – Bug #1114: XSS Vulnerability in strip_tags
  • Bug #1118: Missing caption in file redmine.rb
  • Bug #1134: HEAD is not considered a read-only method in Redmine.pm
  • Bug #1142: Darcs repository adapter doesn’t work with newer versions (~2.5) of Darcs
  • Bug #1144: configuration.yml.example is broken
  • Bug #1188: Selecting “Current project and its subprojects” isn’t saving.
  • Bug #1194: Problems migrating from chili 2.0.0 to 3.3.0
  • Security – Bug #1195: SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664)
  • Bug #1197: Links to new and existing Pages in chili wikis have the same color. Thats boring.
  • Task #1192: Add a CONTRIBUTION document

Contributors to 3.4.0

  • Alf Gaida
  • Carlos Moreira
  • Felix Schäfer
  • Holger Just
  • Jean-Philippe Lang
  • Toshi MARUYAMA

ChiliProject 3.2.2 released

ChiliProject 3.2.2 has just been released. This release is a security release to fix two security issues of Rails (CVE-2012-2694 and CVE-2012-2695) which allowe attackers to inject certain forms of SQL into the database queries generated by ChiliProject. The bugs were fixed in Rails 3.2.6. We have backported them to the version of Rails we use right now.

This release contains no other bug fixes or new features. It is suitable for use on production websites running ChiliProject 3.x and we highly recommend that all users of ChiliProject download and install the security release immediately.

Users of the old 2.x release branch, please check the 2.7.3 release which includes the security fixes. User still running an old 1.x install are strongly encouraged to update to a more recent version as that branch is not supported any more and doesn’t receive updates.

We apologize for the unusual large number of patch releases lately. The vulnerabilities fixed in the this and the last release are located in Ruby on Rails, a Web framework we use as the basis for ChiliProject. The bugs were announced by Rails and are thus publicly known. As we strive to keep our users as secure as possible we thus release security updates as fast as we can to allow responsible administrators to update their installations in a timely fashion and keep their systems secure.

Download ChiliProject 3.2.2

What’s included

3.2.2 includes two security fixes

  • Bug #1036: Ruby on Rails Unsafe Query Generation Risk in Ruby on Rails (CVE-2012-2694)
  • Bug #1037: SQL Injection Vulnerability in Ruby on Rails (CVE-2012-2695)

If you think you have found a security issue in ChiliProject please report it to the security team privately so we can follow responsible disclosure.

ChiliProject 2.7.3 released

ChiliProject 2.7.3 has just been released. This release is a security release to fix two security issues of Rails (CVE-2012-2694 and CVE-2012-2695) which allowe attackers to inject certain forms of SQL into the database queries generated by ChiliProject. The bugs were fixed in Rails 3.2.6. We have backported them to the version of Rails we use right now.

This release contains no other bug fixes or new features and is released for users who are unable to upgrade to ChiliProject 3.2.2. It is suitable for use on production websites running ChiliProject 2.x and we highly recommend that 2.x users download and install the security release immediately.

We apologize for the unusual large number of patch releases lately. The vulnerabilities fixed in the this and the last release are located in Ruby on Rails, a Web framework we use as the basis for ChiliProject. The bugs were announced by Rails and are thus publicly known. As we strive to keep our users as secure as possible we thus release security updates as fast as we can to allow responsible administrators to update their installations in a timely fashion and keep their systems secure.

Download ChiliProject 2.7.3

What’s included

2.7.3 includes two security fixes which were backported from ChiliProject 3.2.2.

  • Bug #1036: Ruby on Rails Unsafe Query Generation Risk in Ruby on Rails (CVE-2012-2694)
  • Bug #1037: SQL Injection Vulnerability in Ruby on Rails (CVE-2012-2695)

If you think you have found a security issue in ChiliProject please report it to the security team privately so we can follow responsible disclosure.

What’s Next?

The 2.x versions of ChiliProject are officially in maintenance mode and will only be getting security updates until the release of 4.0. After that date the 2.x branch is no longer supported in any way. We recommend upgrading to the current stable version of ChiliProject in order to get general bug fixes and features, currently ChiliProject 3.2.2.

ChiliProject 3.2.0 released

ChiliProject 3.2.0 has just been released. It includes some new features and bugfixes for ChiliProject 3.1.0 as well as a security fix of Rails which was backported to our version. It is suitable for use on production websites and we recommend that all users download the release as soon as possible.

Users of the old 2.x release branch, please check the 2.7.2 release which includes the security fix. User still running an old 1.x install are strongly encouraged to update to a more recent version as that branch is not supported any more and doesn’t receive updates.

Download ChiliProject 3.2.0

What’s included

3.2.0 includes 18 bug fixes including one security fix and 6 features for 3.1.0.

The security fix addresses a bug in the parsing of requests by ActionPack. The bug (CVE-2012-2660) was fixed in Rails 3.2.4 and was backported to the Rails version used by us.

The full list of changes is below:

  • Bug #844: Set autocomplete=off for some fields in Registration form
  • Bug #863: missing journals fixture at test/unit/issue_test.rb
  • Bug #950: jQuery AJAX requests don’t include CSRF token
  • Bug #966: “edit own notes” fails since 3.1.0
  • Bug #967: Menu – Missing translations (French)
  • Bug #968: Forum threads aren’t always displaying “Last Message”
  • Bug #969: Forum URLs in the menu are missing the project_id
  • Bug #970: Long version titles extend outside the group menu when expanding Roadmap
  • Bug #974: menu link broken in duplicate issue mode
  • Bug #975: Start Date is not saved for Versions
  • Bug #984: Cannot unlock a forum thread
  • Bug #986: Notification Mail for Wiki-Changes doesn’t contain change comment
  • Bug #994: select all in issue list isn’t working
  • Bug #1007: Right clicking on item in roadmap displays menu at incorrect position
  • Bug #1008: error 500 when uploading a new file to an existing document
  • Bug #1024: Select multiple issues with shift key in issue list
  • Bug #1025: Rails: Unsafe Query Generation Risk in Ruby on Rails (CVE-2012-2660)
  • Bug #1033: Replace vendored gravatar lib by gem
  • Feature #749: Git Integration: Property Main Branch
  • Feature #947: Reformat the CSS files to use a standard
  • Feature #983: Bulgarian translation of several strings
  • Feature #988: Swedish translation of several strings
  • Feature #1016: Limit height of project drop down menu
  • Task #982: Updated czech localization for chiliproject 3.1

Contributors to 3.2.0

  • Andrew Smith
  • Björn Blissing
  • Eric Davis
  • Felix Schäfer
  • Gabriel Mazetto
  • Holger Just
  • Ivan Cenov
  • Jean-Philippe Lang
  • Justin Geibel
  • Sébastien Santoro
  • Spenser Jones
  • Toshi MARUYAMA

What’s next?

As some of you might have noticed, this release was a bit delayed. This was necessary because all members of the core team were heavily occupied with their lifes outside of the Open Source space recently, mostly by completing University assignments. However, we are confident that this period is now over and we strive to return to our regular release schedule. We hope you understand our case and continue to support us in our path to create the best project management solution out there.

Going further, we will intensify our work on the new branch for the 4.0 release where we are going to upgrade to Rails 3.2. The details of this conversion process as well as some more insight into our roadmap are going to be detailed in their own blog posts in the next days.

In closing, go and download ChiliProject 3.2.0 now.

ChiliProject 2.7.2 released

ChiliProject 2.7.2 has just been released. This release is a security release to fix a security issue of Rails (CVE-2012-2660). It addresses a bug in the parsing of requests by ActionPack. It was fixed in Rails 3.2.4 and was backported to the Rails version used by us.

This release contains no other bug fixes or new features and is released for users who are unable to upgrade to ChiliProject 3.2.0. It is suitable for use on production websites running ChiliProject 2.x and we highly recommend that 2.x users download the release. For more information about the bug, please see the release announcement for ChiliProject 3.2.0.

Download ChiliProject 2.7.2

What’s included

2.7.2 includes a security fix which was backported from ChiliProject 3.2.0.

  • Bug #1025: Rails: Unsafe Query Generation Risk in Ruby on Rails (CVE-2012-2660)

If you think you have found a security issue in ChiliProject please report it to the security team privately so we can follow responsible disclosure.

What’s Next?

The 2.x versions of ChiliProject are officially in maintenance mode and will only be getting security updates until the release of 4.0. After that date the 2.x branch is no longer supported in any way. We recommend upgrading to the current stable version of ChiliProject in order to get general bug fixes and features, currently ChiliProject 3.2.0.

ChiliProject 2.7.1 released

ChiliProject 2.7.1 has just been released. This release is a security release to fix several mass-assignment vulnerabilities. It contains no other bug fixes or new features and is released for users who are unable to upgrade to ChiliProject 3.1.0. It is suitable for use on production websites running ChiliProject 2.x and we highly recommend that 2.x users download the release. For more information about the bug, please see the release announcement for ChiliProject 3.1.0.

Download ChiliProject 2.7.1

What’s included

2.7.1 includes a security fix which was backported from ChiliProject 3.1.0.

  • Bug #922: Mass assignment

Contributors to 2.7.1

I’d like to thank all of the contributors to the 2.7.1 release.

  • Eric Davis
  • Holger Just
  • Jean-Philippe Lang

If you think you have found a security issue in ChiliProject please report it to the security team privately so we can follow responsible disclosure.

What’s Next?

The 2.x versions of ChiliProject are officially in maintenance mode and will only be getting security updates until the release of 4.0. After that date the 2.x branch is no longer supported in any way. We recommend upgrading to the current stable version of ChiliProject in order to get general bug fixes and features, currently ChiliProject 3.1.0.

ChiliProject 3.1.0 released

ChiliProject 3.1.0 has just been released. It includes some new features and bugfixes for ChiliProject 3.0.0 as well as some critical security fixes. It is suitable for use on production websites and we recommend that all users download the release as soon as possible.

Users of the old 2.x release branch, please check the 2.7.1 release which includes the security fixes. User still running an old 1.x install are strongly encouraged to update to a more recent version as that branch is not supported any more and doesn’t receive updates.

Download ChiliProject 3.1.0

What’s included

3.1.0 includes 20 bug fixes including one security fix and 5 new features for 3.0.0.

The security fix addresses several the mass assignment vulnerabilities in ChiliProject. These allowed users to write certain pieces of data which they should not have been allowed to. However users could not grant themselves access to data they can’t normally access. It was also not possible for non-admins to grant users additional rights.

All of the vulnerabilities existed since the start of the project, most going back to the beginning of Redmine itself. To further mitigate the issue, we are going to review the controller code and add additional means to prevent mass-assignment vulnerabilities in the future. As these changes require some architectural changes, we will spread them out over the future releases as part of our migration to Rails 3.

More information about the way mass-assignment works in Rails can be found at Michael Hartl’s tech blog.

The full list of changes is below:

  • Bug #739: Relative textile links not converted to full URLs in emails
  • Bug #828: uninitialized constant Redmine::Scm::Adapters::CommandFailed in RepositoryController
  • Bug #861: Apply Filter does not work on all-project-activities view
  • Bug #868: Done bar has no filling
  • Bug #869: Issue option list stacked vertically instead of horizontally
  • Bug #873: Incorrect error message text for groups
  • Bug #882: Right click context menu doesn’t show submenu icon.
  • Bug #887: Stacked month (top row)
  • Bug #888: Cannot edit note
  • Bug #891: quotes around path when shelling out does not work on Windows
  • Bug #892: CP code or test assumes ordering where none is guaranteed
  • Bug #896: Enabling “Authentication required” mode returns 404s
  • Bug #903: ActionView::TemplateError (undefined method `new0′ for DateTime:Class)
  • Bug #911: Sub-sub (and deeper) issues CSS rules are overridden
  • Bug #914: comments gets striked through, when description changes before
  • Bug #922: Mass assignment
  • Bug #927: Reposman script problem
  • Bug #929: Missing links in Issues section in left menu bar
  • Bug #933: News RSS Feed tag not populating
  • Bug #939: GMail documentation in configuration.yml.default out of date
  • Feature #559: Group Menus
  • Feature #899: Create a jQuery verison of the context menu
  • Feature #906: Add Link back to Parent of Subtask
  • Feature #915: default bundle install installs old pg version
  • Feature #928: Increase username length limit from 30 to 60

Contributors to 3.1.0

  • Andrew Smith
  • Dominique Feyer
  • Eric Davis
  • Felix Schäfer
  • Gregor Schmidt
  • Holger Just
  • Jean Philippe Lang
  • Martin S
  • Michaël Rigart
  • Robert Mitwicki

In closing, go and download ChiliProject 3.1.0 now.

ChiliProject 1.5.5 Released

ChiliProject 1.5.5 has just been released. This release is a security release to fix a cache poisoning bug in the bundle Redmine.pm module which can be used for authenticating and authorizing subversion or git users for repositories served through Apache. It contains no other bug fixes or new features and is released for users who are unable to upgrade to ChiliProject 2.5.0. It is suitable for use on production websites running ChiliProject 1.x and we highly recommend that 1.x users download the release.

Download ChiliProject 1.5.5

What’s included

1.5.5 includes a security fix which was back ported from ChiliProject 2.5.0.

  • Bug #709: Redmine.pm potential security issue with cache credential enabled and subversion

All users of ChiliProject who use the bundled Redmine.pm module are strongly advised to update their installations as soon as possible as the resolved issue potentially allows users to access restricted repository data.

Users of Redmine should be advised that the fixed issue is also present there. There is currently no Redmine release that fixes the it. Currently it is only addressed in the trunk and 1.3-stable branch in the repository. You should either upgrade or apply the fix in the issue manually.

Contributors to 1.5.5

I’d like to thank all of the contributors to the 1.5.5 release.

  • Holger Just
  • Jean-Philippe Lang

We would like to especially thank Niels Lindenthal who informed us of the security issue.

If you think you have found a security issue in ChiliProject please report it to the security team privately so we can follow responsible disclosure.

What’s Next?

The 1.x versions of ChiliProject are officially in maintenance mode and will only be getting security updates until the release of 3.0 in early January. After that date the 1.x branch is no longer supported in any way. We recommend upgrading to the current stable version of ChiliProject in order to get general bug fixes and features, currently ChiliProject 2.5.0.

ChiliProject 2.5.0 Released

ChiliProject 2.5.0 has just been released. It includes some bugfixes for ChiliProject 2.4.0 as well as one security fix. It is suitable for use on production websites and we recommend that all users download the release as soon as possible.

Users of the old 1.x release branch, please check the 1.5.5 release which includes the security fix.

Download ChiliProject 2.5.0

What’s included

2.5.0 includes 3 new features and 9 bug fixes including 1 security fix for 2.4.0. The major highlights of this release are:

  • The provided perl module Redmine.pm for authenticating and authorizing subversion or git users for repositories served through Apache was vulnerable to a cache poisoning attack if caching was enabled. The vulnerability could result in a temporary permissions escalation giving a user write permission to a repository she normally had only read permission. The fix will be immediately active after installation and reboot of the Apache the Redmine.pm is installed on.
  • Registered but not-yet activated users can now be deleted.
  • ChiliProject will be transitioning to jQuery as the primary javascript library for client-side scripting. To ease the transition, plugin developers can query ChiliProject::Compatibility to decide if they want to use the to-be-bundled jQuery or use a version they bundle with their plugin. ChiliProject::Compatibility can also be queried to check for the presence or absence of Prototype.
  • 2 view hooks have been added to the Project index.
  • Still more Ruby 1.9 compatibility fixes.
  • The vendored ruby-net-ldap gem has been removed and replaced by an updated version (now called net-ldap) in the Gemfile.
  • Small bug fixes and translation improvements.

All users of ChiliProject are strongly advised to update their installations as soon as possible.

Users of Redmine should be advised that the fixed security issue of Redmine.pm is also present there. There is currently no Redmine release that fixes the it. Currently it is only addressed in the trunk and 1.3-stable branch in the repository. You should either upgrade or apply the fix manually.
The full list of changes are below:

  • Bug #258: Upgrade from ruby-net-ldap to net-ldap gem
  • Bug #554: Failed to migrate from 1.2.0 to 2.1.0 with Ruby 1.9.2
  • Bug #688: doc/CHANGELOG.rdoc is very huge
  • Bug #698: Searching in issue is broken on ruby 1.9
  • Bug #707: Wiki diffs: incompatible character encoding error on Ruby 1.9.2
  • Bug #709: Redmine.pm potential security issue with cache credential enabled and subversion
  • Bug #711: translation missing: en, field_lock_version on issue edit on Ruby 1.9
  • Bug #735: any user can edit time entries via context menu
  • Bug #736: Adding users with a dash “-” in email address is broken sometimes
  • Feature #124: User deletion
  • Feature #706: Add hooks to view projects/index.rhtml
  • Feature #725: Compatibility check for jQuery and Prototype availability

Contributors to 2.5.0

  • David O
  • Eric Davis
  • Felix Schäfer
  • Gregor Schmidt
  • Holger Just
  • Ivan Cenov
  • Jan Schulz-Hofen
  • Jean Philippe Lang
  • Moritz Breit

We would like to especially thank Niels Lindenthal and Jan Schulz-Hofen who informed us of the (potential) security issues. If you think you have found a security issue in ChiliProject please report it to the security team privately so we can follow responsible disclosure.

In closing, go and download ChiliProject 2.5.0 now.