| title | sidebar_navigation | release_version | release_date | ||
|---|---|---|---|---|---|
OpenProject 12.0.4 |
|
12.0.4 |
2021-12-14 |
Release date: 2021-12-14
We released OpenProject 12.0.4. The release contains several bug fixes and we recommend updating to the newest version.
OpenProject versions >= 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticated users with the "Edit budgets" permission, the request to reassign work packages to another budget unsufficiently sanitizes user input in the reassign_to_id parameter.
The vulnerability has been fixed in version 12.0.4. Versions prior to 12.0.0 are not affected. If you're upgrading from an older version, ensure you are upgrading to at least version 12.0.4.
If you are unable to upgrade in a timely fashion, the following patch can be applied: https://github.com/opf/openproject/pull/9983.patch
This security issue was responsibly disclosed by Daniel Santos (Twitter @bananabr). Thank you for reaching out to us and your help in identifying this issue. If you have a security vulnerability you would like to disclose, please see our statement on security.
- Fixed: Frontend including editor and time logging unusable when there are many activities [#40314]
- Fixed: Change of View within OpenProject triggers reload of Viewer [#40315]
A big thanks to community members for reporting bugs and helping us identifying and providing fixes.
Special thanks for reporting and finding bugs go to
Daniel Santos Valentin Ege