CVE-2025-27150: Tuleap dumps the Redis password into the generated troubleshooting archives
Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect the Redis instance is not purged from the archive generated with tuleap collect-system-data. These archives are likely to be used by support teams that should not have access to this password. The vulnerability is fixed in Tuleap Community Edition 16.4.99.1740492866 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tuleap Community Editionto a version that resolves this vulnerability.Fixed in 16.4.99.1740492866 - Upgrade
Upgrade
Tuleap Enterprise Editionto a version that resolves this vulnerability.Fixed in 16.4-6 - Upgrade
Upgrade
Tuleap Enterprise Editionto a version that resolves this vulnerability.Fixed in 16.3-11 - Operational
Ensure any troubleshooting archives generated with `tuleap collect-system-data` are handled as sensitive because Tuleap dumps the Redis password into them; restrict access so support teams that should not have access to the Redis password cannot access those archives.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27150?
CVE-2025-27150 has been classified as a medium severity vulnerability due to the exposure of sensitive information such as password information in generated archives.
How do I fix CVE-2025-27150?
To fix CVE-2025-27150, users should upgrade to Tuleap version 16.4.99.1740492867 or a later version that addresses this issue.
Who is affected by CVE-2025-27150?
CVE-2025-27150 affects users of Tuleap Community Edition up to version 16.4.99.1740492866 and Tuleap Enterprise Edition versions between 16.4-6 and 16.3-11.
What data is compromised in CVE-2025-27150?
CVE-2025-27150 compromises access credentials for the Redis instance, which could allow unauthorized users access to sensitive data.
Is there a workaround for CVE-2025-27150?
There is no official workaround for CVE-2025-27150; the recommended action is to update to the latest software version.