Redmine

Go MAEDA wrote:

Although it would be more user-friendly to display such a message, I think the patch can be merged as-is because Redmine currently don't show such warning when resseting session by timeout or some reasons.

I agree. We also destroy / logout other sessions on password change without any further warning. I think this can be merged as is.

CVE-2021-37156 was assigned for this.

The CVE entry is not yet public. Once we have a release with this fix, we have to update the CVE entry on https://cveform.mitre.org/ and add a reference to the news and the updated /Security_Advisories page.

We can cut a release this weekend, is it ok?

Sure!

Holger Just wrote:

Thank you! I tested the test (heh) and it appears to work correctly (fails without the original patch, works with both in place). I think this one can be merged.

The second part of the patch is however still untested, namely that concurrent active sessions are destroyed if 2fa is activated. I'm not sure how we can properly test the handling of concurrent sessions though...

In any case, could you (Marius and Maeda-san) coordinate to merge this in time before the release?

Yes, I can do it later today.

For the security scanner, I would then use the following definition after the release:

  register(
    id:        '2021-08-01',
    category:  :privilege_escalation,
    severity:  :low,
    details:   'User sessions not reset after activation of two-factor authentication',
    ticket_id: '35417',
    cves:      ['CVE-2021-37156'],
    fixed_in:  ['< 4.2.0', '>= 4.2.2']
  )

with the following title:

User sessions not reset after activation of two-factor authentication

and description:

When enabling two-factor authentication for a user's account, Redmine allows existing user sessions to continue, resulting in increased risk if an attacker has or gets control of one of those other sessions.

Holger Just wrote:

For the security scanner, I would then use the following definition after the release:

[...]

with the following title:

User sessions not reset after activation of two-factor authentication

and description:

When enabling two-factor authentication for a user's account, Redmine allows existing user sessions to continue, resulting in increased risk if an attacker has or gets control of one of those other sessions.

Thanks Holger for your feedback and also for your updates made today to the Wiki page. I saw that you updated the severity to Medium for this issue and then you reverted without any comment. Is it ok or you reverted by mistake?

When updating the security scanner yesterday, I thought a bit more about the possible impact of this. After comparing it with other issues we had tagged as "low" in the past, I came to the conclusion that this probably deserved a medium. I initially tagged it in the security scanner as such.

Only after having updated the severity in the wiki page however, I saw that you mentioned the severity in the release news article as low. Unwilling to change it there too and convinced that consistency is more important than my hunch of severity, I reverted it everywhere back to low. Sorry for this back-and-forth :(

Holger Just wrote:

When updating the security scanner yesterday, I thought a bit more about the possible impact of this. After comparing it with other issues we had tagged as "low" in the past, I came to the conclusion that this probably deserved a medium. I initially tagged it in the security scanner as such.

Only after having updated the severity in the wiki page however, I saw that you mentioned the severity in the release news article as low. Unwilling to change it there too and convinced that consistency is more important than my hunch of severity, I reverted it everywhere back to low. Sorry for this back-and-forth :(

Don't worry, I just wanted to double check this with you. In the future, I will avoid posting the severity in the news post.

I have requested an update for CVE-2021-37156 on https://cveform.mitre.org/ with the following references:

• https://www.redmine.org/news/132
• https://www.redmine.org/projects/redmine/wiki/Security_Advisories

The CVE should be published in the next few hours with this new information.