<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<TITLE> [Mageia-dev] Freeze push: redmine 1.3.2
</TITLE>
<LINK REL="Index" HREF="index.html" >
<LINK REL="made" HREF="mailto:mageia-dev%40mageia.org?Subject=Re%3A%20%5BMageia-dev%5D%20Freeze%20push%3A%20redmine%201.3.2&In-Reply-To=%3CCAOfq2QTSrDY4BQf1yKr47hykse4c%2B10qwsut6mF_ZLg-mZD9WA%40mail.gmail.com%3E">
<META NAME="robots" CONTENT="index,nofollow">
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
<LINK REL="Previous" HREF="014010.html">
<LINK REL="Next" HREF="014045.html">
</HEAD>
<BODY BGCOLOR="#ffffff">
<H1>[Mageia-dev] Freeze push: redmine 1.3.2</H1>
<B>Funda Wang</B>
<A HREF="mailto:mageia-dev%40mageia.org?Subject=Re%3A%20%5BMageia-dev%5D%20Freeze%20push%3A%20redmine%201.3.2&In-Reply-To=%3CCAOfq2QTSrDY4BQf1yKr47hykse4c%2B10qwsut6mF_ZLg-mZD9WA%40mail.gmail.com%3E"
TITLE="[Mageia-dev] Freeze push: redmine 1.3.2">fundawang at gmail.com
</A><BR>
<I>Mon Apr 9 06:27:03 CEST 2012</I>
<P><UL>
<LI>Previous message: <A HREF="014010.html">[Mageia-dev] Freeze push: redmine 1.3.2
</A></li>
<LI>Next message: <A HREF="014045.html">[Mageia-dev] Freeze push: redmine 1.3.2
</A></li>
<LI> <B>Messages sorted by:</B>
<a href="date.html#14037">[ date ]</a>
<a href="thread.html#14037">[ thread ]</a>
<a href="subject.html#14037">[ subject ]</a>
<a href="author.html#14037">[ author ]</a>
</LI>
</UL>
<HR>
<!--beginarticle-->
<PRE>ping?
2012/4/8 Funda Wang <<A HREF="https://www.mageia.org/mailman/listinfo/mageia-dev">fundawang at gmail.com</A>>:
><i> Hello,
</I>><i>
</I>><i> Could somebody pushing redmine 1.3.2 into cauldron?
</I>><i>
</I>><i> Redmine before 1.3.2 does not properly restrict the use of a hash to
</I>><i> provide values for a model's attributes, which allows remote attackers
</I>><i> to set attributes in the (1) Comment, (2) Document, (3) IssueCategory,
</I>><i> (4) MembersController, (5) Message, (6) News, (7) TimeEntry, (8)
</I>><i> Version, (9) Wiki, (10) UserPreference, or (11) Board model via a
</I>><i> modified URL, related to a "mass assignment" vulnerability, a
</I>><i> different vulnerability than CVE-2012-0327.
</I>><i>
</I>><i> Thanks.
</I></PRE>
<!--endarticle-->
<HR>
<P><UL>
<!--threads-->
<LI>Previous message: <A HREF="014010.html">[Mageia-dev] Freeze push: redmine 1.3.2
</A></li>
<LI>Next message: <A HREF="014045.html">[Mageia-dev] Freeze push: redmine 1.3.2
</A></li>
<LI> <B>Messages sorted by:</B>
<a href="date.html#14037">[ date ]</a>
<a href="thread.html#14037">[ thread ]</a>
<a href="subject.html#14037">[ subject ]</a>
<a href="author.html#14037">[ author ]</a>
</LI>
</UL>
<hr>
<a href="https://www.mageia.org/mailman/listinfo/mageia-dev">More information about the Mageia-dev
mailing list</a><br>
</body></html>