Description
Best Practical Solutions RT 3.x before 3.8.9rc2 and 4.x before 4.0.0rc4 uses the MD5 algorithm for password hashes, which makes it easier for context-dependent attackers to determine cleartext passwords via a brute-force attack on the database.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | request-tracker3.6 | 3.6.7-5+lenny5 | DSA-2150-1 |
Advisories 1
- DSA-2150-1 request-tracker3.6 - salt password hashing Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-2150 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610850
- ADV-2011-0576 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=672250
- 43438 third-party-advisory
- FEDORA-2011-1677 vendor-advisory
- [rt-announce] 20110119 Security vulnerability in RT 3.0 and up mailing-list
- 70661 vdb-entry
- ADV-2011-0190 vdb-entry
- ADV-2011-0475 vdb-entry
- 45959 vdb-entry
- [mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar mailing-list