Tuleap Redis Password Exposure Vulnerability

A vulnerability exists in Tuleap's system data collection process, where the password for the Redis instance is not removed from the generated troubleshooting archives. This oversight could lead to unauthorized access, as these archives are typically reviewed by support teams that should not have access to such sensitive information. The issue affects Tuleap Community Edition versions prior to 16.4.99.1740492866 and Tuleap Enterprise Edition versions prior to 16.4-6 and 16.3-11.

Impact

The vulnerability allows for the unintended disclosure of the Redis password in debug archives, which may be accessed by support teams.

Remediation

Users can upgrade to Tuleap Community Edition 16.4.99.1740492866 or Tuleap Enterprise Edition 16.4-6 or 16.3-11 to address this vulnerability.