openproject/docs/release-notes/12-0-4

title	sidebar_navigation	release_version	release_date
OpenProject 12.0.4	[{title 12.0.4}]	12.0.4	2021-12-14

OpenProject 12.0.4

Release date: 2021-12-14

We released OpenProject 12.0.4. The release contains several bug fixes and we recommend updating to the newest version.

CVE-2021-43830

OpenProject versions >= 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticated users with the "Edit budgets" permission, the request to reassign work packages to another budget unsufficiently sanitizes user input in the reassign_to_id parameter.

Patches

The vulnerability has been fixed in version 12.0.4. Versions prior to 12.0.0 are not affected. If you're upgrading from an older version, ensure you are upgrading to at least version 12.0.4.

Workaround

If you are unable to upgrade in a timely fashion, the following patch can be applied: https://github.com/opf/openproject/pull/9983.patch

Credits

This security issue was responsibly disclosed by Daniel Santos (Twitter @bananabr). Thank you for reaching out to us and your help in identifying this issue. If you have a security vulnerability you would like to disclose, please see our statement on security.

Bug fixes and changes

• Fixed: Frontend including editor and time logging unusable when there are many activities [#40314]
• Fixed: Change of View within OpenProject triggers reload of Viewer [#40315]

Contributions

A big thanks to community members for reporting bugs and helping us identifying and providing fixes.

Special thanks for reporting and finding bugs go to

Daniel Santos Valentin Ege