On Thursday, August 6, 2026 9:18:15 PM Mountain Standard Time Soren Stoutner wrote: > On Thursday, August 6, 2026 9:04:10 PM Mountain Standard Time Salvatore > > Bonaccorso wrote: > > Hi, > > > > On Fri, Aug 07, 2026 at 02:35:03AM +0000, Debian Bug Tracking System wrote: > > > [ Soren Stoutner ] > > > * New upstream version (closes: #1140483 - CVE-2026-1836). > > > > Is there more information on the fix? Can you point us to it? The > > original tracking only hat the incibe.es posting: > > https://www.incibe.es/en/incibe-cert/notices/aviso/stored-credentials-redmin > > e > > which unfortunately is bit light on details apart only saying which > > version is fixed. > > Upstream is light on public information about this fix. The changelog says > this: > > "Defect #42998: Username and password stored in login form" > > https://www.redmine.org/projects/redmine/wiki/Changelog_6_0 > > The commits that fix this CVE are here: > > https://github.com/search? > q=repo%3Aredmine%2Fredmine+merge%3Afalse+42998&type=commits
If you are asking what the original flaw entailed, it was that browsers would cache the authentication fields until the browser was closed. So, if someone logged into a Redmine instance using a public computer, logged out, but then *didn’t close the browser*, it would be possible for the next user to extract the authentication information from the browser. The fix is to mark the fields as "no-store" to the Cache-Control header. Although this attack vector is a possibility, prior to the fix it could be mitigated by the user if they closed the browser on a shared machine after logging out. -- Soren Stoutner [email protected]
signature.asc
Description: This is a digitally signed message part.
