[DRE-maint] Bug#1140483: closed by Debian FTP Masters <ftpmaster at ftp-master.debian.org> (reply to Soren Stoutner <soren at debian.org>) (Bug#1140483: fixed in redmine 6.1.3+ds-1)

[Soren Stoutner]

On Thursday, August 6, 2026 9:18:15 PM Mountain Standard Time Soren Stoutner 
wrote:
> On Thursday, August 6, 2026 9:04:10 PM Mountain Standard Time Salvatore
> 
> Bonaccorso wrote:
> > Hi,
> > 
> > On Fri, Aug 07, 2026 at 02:35:03AM +0000, Debian Bug Tracking System 
wrote:
> > >    [ Soren Stoutner ]
> > >    * New upstream version (closes: #1140483 - CVE-2026-1836).
> > 
> > Is there more information on the fix? Can you point us to it? The
> > original tracking only hat the incibe.es posting:
> > https://www.incibe.es/en/incibe-cert/notices/aviso/stored-credentials-redmin
> > e
> > which unfortunately is bit light on details apart only saying which
> > version is fixed.
> 
> Upstream is light on public information about this fix.  The changelog says
> this:
> 
> "Defect #42998: Username and password stored in login form"
> 
> https://www.redmine.org/projects/redmine/wiki/Changelog_6_0
> 
> The commits that fix this CVE are here:
> 
> https://github.com/search?
> q=repo%3Aredmine%2Fredmine+merge%3Afalse+42998&type=commits

If you are asking what the original flaw entailed, it was that browsers would 
cache the authentication fields until the browser was closed.  So, if someone 
logged into a Redmine instance using a public computer, logged out, but then 
*didn’t close the browser*, it would be possible for the next user to extract 
the authentication information from the browser.  The fix is to mark the 
fields as "no-store" to the Cache-Control header.

Although this attack vector is a possibility, prior to the fix it could be 
mitigated by the user if they closed the browser on a shared machine after 
logging out.

-- 
Soren Stoutner
soren at debian.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part.
URL: <http://alioth-lists.debian.net/pipermail/pkg-ruby-extras-maintainers/attachments/20260806/af3c3f12/attachment.sig>