Candidate: CVE-2015-8473
PublicDate: 2016-04-12 14:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8473
 https://www.redmine.org/projects/redmine/wiki/Changelog_3_0
 https://www.redmine.org/issues/21136
 http://www.openwall.com/lists/oss-security/2015/12/03/7
 https://github.com/redmine/redmine/commit/8d8f612fa368a72c56b63f7ce6b7e98cab9feb22
Description:
 The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x
 before 3.1.2 allows remote authenticated users to obtain sensitive
 information in changeset messages by leveraging permission to read issues
 with related changesets from other projects.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=807345
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N [4.3 MEDIUM]

Patches_redmine:
 upstream: https://github.com/redmine/redmine/commit/8d8f612fa368a72c56b63f7ce6b7e98cab9feb22
upstream_redmine: released (2.6.8, 3.0.6 and 3.1.2)
precise_redmine: ignored (reached end-of-life)
precise/esm_redmine: DNE (precise was needed)
trusty_redmine: ignored (reached end-of-life)
trusty/esm_redmine: DNE (trusty was needed)
vivid_redmine: ignored (reached end-of-life)
vivid/stable-phone-overlay_redmine: DNE
vivid/ubuntu-core_redmine: DNE
wily_redmine: ignored (reached end-of-life)
xenial_redmine: not-affected (3.2.0-1)
yakkety_redmine: ignored (reached end-of-life)
zesty_redmine: ignored (reached end-of-life)
artful_redmine: not-affected (3.2.0-1)
bionic_redmine: not-affected (3.2.0-1)
cosmic_redmine: not-affected (3.2.0-1)
disco_redmine: not-affected (3.2.0-1)
devel_redmine: not-affected (3.2.0-1)