CVE-2012-2054

NameCVE-2012-2054
DescriptionRedmine before 1.3.2 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set attributes in the (1) Comment, (2) Document, (3) IssueCategory, (4) MembersController, (5) Message, (6) News, (7) TimeEntry, (8) Version, (9) Wiki, (10) UserPreference, or (11) Board model via a modified URL, related to a "mass assignment" vulnerability, a different vulnerability than CVE-2012-0327.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
redmine (PTS)bookworm, bookworm (security)5.0.4-5+deb12u1fixed
sid5.0.4-7fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
redminesourcesqueeze(unfixed)end-of-life
redminesource(unstable)1.3.2+dfsg1-1

Notes

[squeeze] - redmine <end-of-life> (Redmine not supported because of rails)
http://www.redmine.org/issues/10390
git mirror patch would be 5141f1e..177ff05

Search for package or bug name: Reporting problems