kanboard - Debian Package Tracker

general

source: kanboard (main)
version: 1.2.31+ds2-1
maintainer: Joseph Nahmias (DMD)
arch: all
std-ver: 4.6.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

stable: 1.2.26+ds-2+deb12u2
stable-sec: 1.2.26+ds-2+deb12u2
unstable: 1.2.31+ds2-1

versioned links

1.2.26+ds-2+deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.31+ds2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

kanboard (5 bugs: 3, 2, 0, 0)

action needed

Debci reports failed tests high

unstable: fail (log)
The tests ran in an unknown time
Last run: 2025-01-13T10:06:57.000Z
Previous status: unknown

testing: pass (log)
The tests ran in an unknown time
Last run: 2023-10-11T03:40:10.000Z
Previous status: unknown

stable: pass (log)
The tests ran in an unknown time
Last run: 2024-10-20T08:34:41.000Z
Previous status: unknown

Created: 2025-01-13 Last update: 2025-01-21 00:31

A new upstream version is available: 1.2.43 high

A new upstream version 1.2.43 is available, you should consider packaging it.

Created: 2023-07-13 Last update: 2025-01-21 00:03

6 security issues in sid high

There are 6 open security issues in sid.

6 important issues:

CVE-2024-22720: Kanboard 1.2.34 is vulnerable to Html Injection in the group management feature.
CVE-2024-36399: Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser(). The users permission to add users to a project only get checked on the URL parameter project_id. If the user is authorized to add users to this project the request gets processed. The users permission for the POST BODY parameter project_id does not get checked again while processing. An attacker with the 'Project Manager' on a single project may take over any other project. The vulnerability is fixed in 1.2.37.
CVE-2024-51747: Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can read and delete arbitrary files from the server. File attachments, that are viewable or downloadable in Kanboard are resolved through its `path` entry in the `project_has_files` SQLite db. Thus, an attacker who can upload a modified sqlite.db through the dedicated feature, can set arbitrary file links, by abusing path traversals. Once the modified db is uploaded and the project page is accessed, a file download can be triggered and all files, readable in the context of the Kanboard application permissions, can be downloaded. This issue has been addressed in version 1.2.42 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2024-51748: Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can run arbitrary php code on the server in combination with a file write possibility. The user interface language is determined and loaded by the setting `application_language` in the `settings` table. Thus, an attacker who can upload a modified sqlite.db through the dedicated feature, has control over the filepath, which is loaded. Exploiting this vulnerability has one constraint: the attacker must be able to place a file (called translations.php) on the system. However, this is not impossible, think of anonymous FTP server or another application that allows uploading files. Once the attacker has placed its file with the actual php code as the payload, the attacker can craft a sqlite db settings, which uses path traversal to point to the directory, where the `translations.php` file is stored. Then gaining code execution after importing the crafted sqlite.db. This issue has been addressed in version 1.2.42 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2024-54001: Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fields application_language, application_date_format,application_timezone and application_time_format allow arbirary user input which is reflected. The vulnerability can become xss if the user input is javascript code that bypass CSP. This vulnerability is fixed in 1.2.41.
CVE-2024-55603: Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though their lifetime has exceeded. Kanboard implements a cutom session handler (`app/Core/Session/SessionHandler.php`), to store the session data in a database. Therefore, when a `session_id` is given, kanboard queries the data from the `sessions` sql table. At this point, it does not correctly verify, if a given `session_id` has already exceeded its lifetime (`expires_at`). Thus, a session which's lifetime is already `> time()`, is still queried from the database and hence a valid login. The implemented **SessionHandlerInterface::gc** function, that does remove invalid sessions, is called only **with a certain probability** (_Cleans up expired sessions. Called by `session_start()`, based on `session.gc_divisor`, `session.gc_probability` and `session.gc_maxlifetime` settings_) accordingly to the php documentation. In the official Kanboard docker image these values default to: session.gc_probability=1, session.gc_divisor=1000. Thus, an expired session is only terminated with probability 1/1000. This issue has been addressed in release 1.2.43 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Created: 2024-01-24 Last update: 2024-12-20 23:02

6 security issues in bookworm high

There are 6 open security issues in bookworm.

4 important issues:

CVE-2024-51747: Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can read and delete arbitrary files from the server. File attachments, that are viewable or downloadable in Kanboard are resolved through its `path` entry in the `project_has_files` SQLite db. Thus, an attacker who can upload a modified sqlite.db through the dedicated feature, can set arbitrary file links, by abusing path traversals. Once the modified db is uploaded and the project page is accessed, a file download can be triggered and all files, readable in the context of the Kanboard application permissions, can be downloaded. This issue has been addressed in version 1.2.42 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2024-51748: Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can run arbitrary php code on the server in combination with a file write possibility. The user interface language is determined and loaded by the setting `application_language` in the `settings` table. Thus, an attacker who can upload a modified sqlite.db through the dedicated feature, has control over the filepath, which is loaded. Exploiting this vulnerability has one constraint: the attacker must be able to place a file (called translations.php) on the system. However, this is not impossible, think of anonymous FTP server or another application that allows uploading files. Once the attacker has placed its file with the actual php code as the payload, the attacker can craft a sqlite db settings, which uses path traversal to point to the directory, where the `translations.php` file is stored. Then gaining code execution after importing the crafted sqlite.db. This issue has been addressed in version 1.2.42 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2024-54001: Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fields application_language, application_date_format,application_timezone and application_time_format allow arbirary user input which is reflected. The vulnerability can become xss if the user input is javascript code that bypass CSP. This vulnerability is fixed in 1.2.41.
CVE-2024-55603: Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though their lifetime has exceeded. Kanboard implements a cutom session handler (`app/Core/Session/SessionHandler.php`), to store the session data in a database. Therefore, when a `session_id` is given, kanboard queries the data from the `sessions` sql table. At this point, it does not correctly verify, if a given `session_id` has already exceeded its lifetime (`expires_at`). Thus, a session which's lifetime is already `> time()`, is still queried from the database and hence a valid login. The implemented **SessionHandlerInterface::gc** function, that does remove invalid sessions, is called only **with a certain probability** (_Cleans up expired sessions. Called by `session_start()`, based on `session.gc_divisor`, `session.gc_probability` and `session.gc_maxlifetime` settings_) accordingly to the php documentation. In the official Kanboard docker image these values default to: session.gc_probability=1, session.gc_divisor=1000. Thus, an expired session is only terminated with probability 1/1000. This issue has been addressed in release 1.2.43 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

2 issues left for the package maintainer to handle:

CVE-2024-22720: (needs triaging) Kanboard 1.2.34 is vulnerable to Html Injection in the group management feature.
CVE-2024-36399: (needs triaging) Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser(). The users permission to add users to a project only get checked on the URL parameter project_id. If the user is authorized to add users to this project the request gets processed. The users permission for the POST BODY parameter project_id does not get checked again while processing. An attacker with the 'Project Manager' on a single project may take over any other project. The vulnerability is fixed in 1.2.37.

You can find information about how to handle these issues in the security team's documentation.

Created: 2024-01-24 Last update: 2024-12-20 23:02

lintian reports 5 errors high

Lintian reports 5 errors about this package. You should make the package lintian clean getting rid of them.

Created: 2024-12-19 Last update: 2024-12-19 19:31

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2023-10-25 Last update: 2025-01-21 00:03

2 bugs tagged patch in the BTS normal

The BTS contains patches fixing 2 bugs, consider including or untagging them.

Created: 2025-01-06 Last update: 2025-01-21 00:00

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.2.38+ds-1~1.gbp446677, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 9bbaabfc8a2bfe46f053eadfad150a5701e7fd5f
Author: Joe Nahmias <joe@nahmias.net>
Date:   Wed Oct 30 00:01:56 2024 -0400

    Update changelog snapshot

commit 44667786e7c01e6fc558f163b6d9ce73c8160ca1
Author: Joe Nahmias <joe@nahmias.net>
Date:   Wed Oct 30 00:01:03 2024 -0400

    refresh patches

commit 23c21fc0a5bd3b4b3b7736e13a789f189e7dd5e3
Author: Joe Nahmias <joe@nahmias.net>
Date:   Wed Oct 30 00:00:42 2024 -0400

    update changelog header

commit 09e82126c99c2262255fab61e89ac06230844b24
Merge: ce72379 c79d0ec
Author: Joe Nahmias <joe@nahmias.net>
Date:   Tue Aug 13 16:22:34 2024 -0400

    Update upstream source from tag 'upstream/1.2.38+ds'
    
    Update to upstream version '1.2.38+ds'
    with Debian dir 59a652dc1a9507c196a672829c882b36d3b6df67

commit c79d0ec4c7fd8deae32cb69400838593a05bcc1e
Author: Joe Nahmias <joe@nahmias.net>
Date:   Tue Aug 13 16:22:31 2024 -0400

    New upstream version 1.2.38+ds

commit ce72379153ceef27f0a59e5a2d7086eab2ea4f8e
Merge: b150a9a e4e2189
Author: Joseph Nahmias <joe@nahmias.net>
Date:   Tue Aug 13 20:18:43 2024 +0000

    Merge branch 'phpunit10' into 'debian/latest'
    
    Add support for phpunit 10
    
    See merge request debian/kanboard!1

commit e4e2189385f867a6c09a35fe47175fe569869f3a
Author: Athos Ribeiro <athoscribeiro@gmail.com>
Date:   Tue Jul 18 10:18:58 2023 -0300

    Update changelog

commit 54a978ea4181ca68d27cf472fb3b6abf183b9539
Author: Athos Ribeiro <athoscribeiro@gmail.com>
Date:   Sun Jul 16 22:54:47 2023 -0300

    comply with phpunit 10 removals and deprecations

commit 3a1912297edbf72ca283ab4272c869d931011d1e
Author: Athos Ribeiro <athoscribeiro@gmail.com>
Date:   Thu Jun 29 20:08:05 2023 -0300

    remove deprecated phpunit verbose option

commit 3787817747796294aeefcefa1bd62a855dec4ca1
Author: Athos Ribeiro <athoscribeiro@gmail.com>
Date:   Thu Jun 29 20:07:28 2023 -0300

    bump Standards-Version to 4.6.2

Created: 2024-08-13 Last update: 2025-01-16 15:03

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.0 instead of 4.6.1).

Created: 2022-12-17 Last update: 2024-04-07 13:15

testing migrations

excuses:
- Migrates after: christianriesen-otp, matthiasmullie-minify
- Migration status for kanboard (- to 1.2.31+ds2-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Updating kanboard would introduce bugs in testing: #1051989, #1052638, #1072791, #1079245, #1088798
- ∙ ∙ autopkgtest for kanboard/1.2.31+ds2-1: amd64: Pass, arm64: Pass, riscv64: Pass, s390x: Regression or new test ♻
- ∙ ∙ Build-Depends(-Arch): kanboard christianriesen-otp
- ∙ ∙ Build-Depends(-Arch): kanboard matthiasmullie-minify
- ∙ ∙ Depends: kanboard christianriesen-otp
- ∙ ∙ Depends: kanboard matthiasmullie-minify
- Additional info:
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/k/kanboard.html
- ∙ ∙ uninstallable on arch armel (which is allowed), not running autopkgtest there
- ∙ ∙ uninstallable on arch armhf (which is allowed), not running autopkgtest there
- ∙ ∙ uninstallable on arch i386 (which is allowed), not running autopkgtest there
- ∙ ∙ Reproducible on amd64 - info ♻
- ∙ ∙ Waiting for reproducibility test results on armhf - info ♻
- ∙ ∙ Waiting for reproducibility test results on i386 - info ♻
- ∙ ∙ 562 days old (needed 5 days)
- Not considered

news

[rss feed]

[2023-10-26] kanboard REMOVED from testing (Debian testing watch)
[2023-07-22] Accepted kanboard 1.2.26+ds-2+deb12u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Joe Nahmias)
[2023-07-16] Accepted kanboard 1.2.26+ds-2+deb12u2 (source) into stable-security (Debian FTP Masters) (signed by: Joe Nahmias)
[2023-07-14] kanboard 1.2.31+ds2-1 MIGRATED to testing (Debian testing watch)
[2023-07-09] Accepted kanboard 1.2.31+ds2-1 (source) into unstable (Joseph Nahmias) (signed by: Joe Nahmias)
[2023-07-09] kanboard 1.2.31+ds-1 MIGRATED to testing (Debian testing watch)
[2023-07-04] Accepted kanboard 1.2.31+ds-1 (source) into unstable (Joseph Nahmias) (signed by: Joe Nahmias)
[2023-07-03] Accepted kanboard 1.2.30+ds-1 (source) into unstable (Joseph Nahmias) (signed by: Joe Nahmias)
[2023-06-28] Accepted kanboard 1.2.26+ds-2+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Joe Nahmias)
[2023-06-13] kanboard 1.2.26+ds-4 MIGRATED to testing (Debian testing watch)
[2023-06-08] Accepted kanboard 1.2.26+ds-4 (source) into unstable (Joseph Nahmias) (signed by: Joe Nahmias)
[2023-06-02] Accepted kanboard 1.2.26+ds-3 (source) into unstable (Joseph Nahmias) (signed by: Joe Nahmias)
[2023-05-24] kanboard 1.2.26+ds-2 MIGRATED to testing (Debian testing watch)
[2023-05-17] Accepted kanboard 1.2.26+ds-2 (source) into unstable (Joseph Nahmias) (signed by: Joe Nahmias)
[2023-01-20] kanboard 1.2.26+ds-1 MIGRATED to testing (Debian testing watch)
[2023-01-15] Accepted kanboard 1.2.26+ds-1 (source) into unstable (Joseph Nahmias) (signed by: Joe Nahmias)
[2023-01-12] Accepted kanboard 1.2.25+ds-3 (source) into unstable (Joseph Nahmias) (signed by: Joe Nahmias)
[2023-01-12] Accepted kanboard 1.2.25+ds-2 (source) into unstable (Joseph Nahmias) (signed by: Joe Nahmias)
[2022-11-17] Accepted kanboard 1.2.25+ds-1 (source) into unstable (Joseph Nahmias) (signed by: Joe Nahmias)
[2022-10-15] Accepted kanboard 1.2.23+ds-1.1 (source) into unstable (Michael Biebl)
[2022-09-13] Accepted kanboard 1.2.23+ds-1 (source) into unstable (Joseph Nahmias) (signed by: Joe Nahmias)
[2022-09-10] Accepted kanboard 1.2.22+ds-1 (source all) into unstable, unstable (Debian FTP Masters) (signed by: Joe Nahmias)

bugs [bug history graph]

all: 13
RC: 5
I&N: 7
M&W: 1
F&P: 0
patch: 2

links

homepage
lintian (5, 0)
buildd: logs
popcon
browse source code
edit tags
other distros
security tracker
screenshots
debian patches
debci