Remote Command Execution Vulnerability in Redmine Package
Summary
DEBIAN-CVE-2011-4929: Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x before 1.0.5 allows remote attackers to execute arbitrary commands via unknown vectors. Affects redmine versions < 1.0.5-1. Fixed in 1.0.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redmine is a flexible project management web application that includes support for various SCM integrations, issue tracking, and project management features. It is widely used in software development and project management environments. The vulnerability in question affects versions 0.9.x and 1.0.x of Redmine, specifically in the bazaar repository adapter, which is responsible for integrating with the Bazaar version control system. This vulnerability allows remote attackers to execute arbitrary commands, posing a significant security risk.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2011-4929 is an unspecified issue in the bazaar repository adapter of Redmine versions prior to 1.0.5. It allows remote attackers to execute arbitrary commands through unknown vectors. This could lead to unauthorized access, data breaches, or further exploitation of the system, making it critical for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
1.0.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade redmineTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the bazaar repository adapter if it is not needed for their project. This can be done by modifying the Redmine configuration files to remove or comment out the bazaar integration settings.
Conclusion
The vulnerability DEBIAN-CVE-2011-4929 poses a serious risk to users of Redmine versions 0.9.x and 1.0.x prior to 1.0.5. It is crucial for users to update their installations to the latest patched version to mitigate the risk of remote command execution. Temporary workarounds are available, but updating is the most effective solution.
See every vulnerability recorded for redmine →
FAQ
Redmine versions 0.9.x and 1.0.x before 1.0.5 are affected by this vulnerability.
Remote attackers can exploit this vulnerability to execute arbitrary commands on the server running Redmine.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, you can disable the bazaar repository adapter as a temporary measure until you can apply the update.
More information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2011-4929.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for redmine.
