Summary
It was discovered that Request Tracker incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to obtain
sensitive information. (CVE-2021-38562, CVE-2022-25802, CVE-2023-41259,
CVE-2023-41260)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | request-tracker4 | 4.4.3-2+deb10u3build0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | request-tracker4 | 4.4.4+dfsg-2ubuntu1.22.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | request-tracker4 | 4.4.2-2ubuntu0.1~esm1 |
Vulnerabilities 4
-
Unscored —
Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive informat…
-
Unscored —
Best Practical Request Tracker (RT) before 4.4.6 and 5.x before 5.0.3 allows XSS via a crafted content type for an atta…
-
Unscored —
Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed…
-
Unscored —
Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-…