MediumFix available
redmine — security advisory
Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing differences in string comparison operations within SysController and MailHandlerController.
- Products
- redmine
- Affected versions
- Not specified
- Fixed versions
- 5.0.0-1
- CVEs
- CVE-2021-31866
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 00:34 UTC · Revision 1
Source evidence
Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing differences in string comparison operations within SysController and MailHandlerController.
osv:DEBIAN-CVE-2021-31866
redmine
Fixed versions: 5.0.0-1
redmine
Fixed versions: 5.0.0-1
redmine
Fixed versions: 5.0.0-1
Complete source record
{
"id": "2626bde2230c7d9a85b3b6e2633820b1a790f884446f02c75115da01a08ba001",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2021-31866",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2021-31866",
"summary": "Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing differences in string comparison operations within SysController and MailHandlerController.",
"evidence": "osv:DEBIAN-CVE-2021-31866",
"products": [
{
"name": {
"value": "redmine",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.0.0-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "redmine",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.0.0-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "redmine",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.0.0-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2021-31866",
"aliases": [
"DEBIAN-CVE-2021-31866"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.0-1"
}
]
}
],
"package": {
"name": "redmine",
"purl": "pkg:deb/debian/redmine?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-31866.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.0-1"
}
]
}
],
"package": {
"name": "redmine",
"purl": "pkg:deb/debian/redmine?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-31866.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.0-1"
}
]
}
],
"package": {
"name": "redmine",
"purl": "pkg:deb/debian/redmine?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-31866.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T18:03:26.570516964Z",
"provider": "osv",
"upstream": [
"CVE-2021-31866"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2021-31866"
]
},
"related_cves": [
{
"value": "CVE-2021-31866",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 421529,
"published_at": "2021-04-28T07:15:07.663+00:00"
}