[SECURITY] [DLA 3642-1] request-tracker4 security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3642-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Salvatore Bonaccorso
October 31, 2023 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : request-tracker4
Version : 4.4.3-2+deb10u3
CVE ID : CVE-2023-41259 CVE-2023-41260
Debian Bug : 1054516
Multiple vulnerabilities have been discovered in Request Tracker, an
extensible trouble-ticket tracking system.
CVE-2023-41259
Tom Wolters reported that Request Tracker is vulnerable to accepting
unvalidated RT email headers in incoming email and the mail-gateway
REST interface.
CVE-2023-41260
Tom Wolters reported that Request Tracker is vulnerable to
information leakage via response messages returned from requests
sent via the mail-gateway REST interface.
For Debian 10 buster, these problems have been fixed in version
4.4.3-2+deb10u3.
We recommend that you upgrade your request-tracker4 packages.
For the detailed security status of request-tracker4 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/request-tracker4
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmVAiChfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0R7LQ//Q/w9fDj89y743khicNeTcOrhe5GseUNYn+OOH/WmkODojXhR+drwpaj1
iFhPloaXpyQ4V5eYMKK0CgHilSyiQJFTdouqxCrF+hzwR4rPDSFyjABvlwDm2+99
Amz7itUo9JBmHeJziy0UNea0I1yfxSjnEVC9mHC9pJTW3Ghn/JZsiGIQcH12aNGv
cu469VDqIFE/jcAC082SWXsdU2zWFIHtxnxVDxLr62xare7oSYprXX9uAomSEBDw
EMnM00dGBkC50qvsebcil+h+9kOIGBTD0QvUXJzZxeFhk8He0+134+z02Db2O5qU
X1SNLL6ohBxQL4Bcg4vIz4ssC1swOpDp/f2yR2e0Vj9CogCy0Xe8fEE/h5Xv3nyk
agFSTxMRnW0ndwms0BlRGJXyb2kwK9CmyHOcDaSRTRqs+TmQSAa8SOv/CbREylPR
uZFkIJCkkUjE2WYCegw1iz8t4rDCmQSpIWhq4v9CglMLBmr6trMoWik+HmXtAHIN
FDwLe3ZegaPhnRitt+/RgWA3hSfzxXWy/r6KyS1kYi4RhXtKVv8Zmbnm3M9GSPMg
GmwdHHdri6Qc0z73uGiyA1+l+vjOMY/dh2v49jhFiB6LWJbdIrVMGsXYUXmt0Nkf
UELqJFbI703TOQaDJO2TCRBSxHBC5PXXcv2vbfgAqu+G/M9Wh9w=
=0a8h
-----END PGP SIGNATURE-----
Reply to: