CVE-2012-6580: Medium severity request tracker vulnerability
Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, does not ensure that the UI labels unencrypted messages as unencrypted, which might make it easier for remote attackers to spoof details of a message's origin or interfere with encryption-policy auditing via an e-mail message to a queue's address.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6580?
CVE-2012-6580 is classified as a medium severity vulnerability due to its potential impact on message integrity and encryption policy enforcement.
How do I fix CVE-2012-6580?
To fix CVE-2012-6580, upgrade to Best Practical Solutions Request Tracker version 3.8.15 or 4.0.8 or later.
Which versions of Request Tracker are affected by CVE-2012-6580?
CVE-2012-6580 affects Request Tracker versions 3.8.x before 3.8.15 and 4.0.x before 4.0.8.
What is the impact of CVE-2012-6580?
The impact of CVE-2012-6580 may allow remote attackers to spoof message details or interfere with encryption policy auditing.
Is GnuPG required for CVE-2012-6580 to be applicable?
Yes, CVE-2012-6580 is applicable only when GnuPG is enabled in the affected versions of Request Tracker.