Medium WID-SEC-2026-2503 2 CVEs

Znuny: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Published Jul 23, 2026 · Updated Jul 23, 2026 · de-DE

Vendor: Znuny Product: Znuny

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Znuny ausnutzen, um Informationen offenzulegen.

Product

Znuny ist eine Open Source Ticketing Software.

Vulnerabilities 2

High 7.5

CVE-2026-6659

Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts

Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts. The built-in rand function is predictable, and unsuitable for cryptography.

RSAVAGE Crypt::PasswdMD5 libcrypt-passwdmd5-perl libcrypt-passwdmd5-perl Debian Ubuntu Azure Linux

May 8, 2026
Medium 6.5

CVE-2026-8368

LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects

LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects. On a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-supplied Authorization …

OALDERS LWP::UserAgent libwww-perl perl-libwww-perl Debian Ubuntu Azure Linux

May 12, 2026

Revision history

2026-07-23 #1
Initiale Fassung

References

Znuny Release Notes vom 2026-07-23
https://www.znuny.org/de/releases/znuny-lts-6-5-23
Znuny Release Notes vom 2026-07-23
https://www.znuny.org/de/releases/znuny-7-3-5
GitHub Advisory Database vom 2026-07-23
https://github.com/advisories/GHSA-J539-XXC6-73WF
GitHub Advisory Database vom 2026-07-23
https://github.com/advisories/GHSA-39WP-J2GG-H44J