Description
Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | trac | 0.11.6-1 | — |
| Debian 13 | trac | 0.11.6-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | trac | < 0.11.6 | 0.11.6 | GHSA-f9qv-j5g6-g5cr |
References
- http://trac.edgewall.org/browser/tags/trac-0.11.6/RELEASE
- FEDORA-2009-12975 vendor-advisory
- ADV-2009-3615 vdb-entry
- 37807 third-party-advisory
- 37901 third-party-advisory
- trac-alternate-security-bypass(54983) vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=542394