CVE-2017-5361: Medium severity request tracker vulnerability

Published Jul 3, 2017

Updated

Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes it easier for remote attackers to obtain sensitive user password information via a timing side-channel attack.

Affected Software

41 affected components

bestpractical Request Tracker=4.0.0

bestpractical Request Tracker=4.0.1

bestpractical Request Tracker=4.0.2

bestpractical Request Tracker=4.0.3

bestpractical Request Tracker=4.0.4

bestpractical Request Tracker=4.0.5

bestpractical Request Tracker=4.0.6

bestpractical Request Tracker=4.0.7

bestpractical Request Tracker=4.0.8

bestpractical Request Tracker=4.0.9

bestpractical Request Tracker=4.0.10

bestpractical Request Tracker=4.0.11

bestpractical Request Tracker=4.0.12

bestpractical Request Tracker=4.0.13

bestpractical Request Tracker=4.0.14

bestpractical Request Tracker=4.0.15

bestpractical Request Tracker=4.0.16

bestpractical Request Tracker=4.0.17

bestpractical Request Tracker=4.0.18

bestpractical Request Tracker=4.0.19

bestpractical Request Tracker=4.0.20

bestpractical Request Tracker=4.0.21

bestpractical Request Tracker=4.0.22

bestpractical Request Tracker=4.0.23

bestpractical Request Tracker=4.0.24

bestpractical Request Tracker=4.2.0

bestpractical Request Tracker=4.2.1

bestpractical Request Tracker=4.2.2

bestpractical Request Tracker=4.2.3

bestpractical Request Tracker=4.2.4

bestpractical Request Tracker=4.2.5

bestpractical Request Tracker=4.2.6

bestpractical Request Tracker=4.2.7

bestpractical Request Tracker=4.2.8

bestpractical Request Tracker=4.2.9

bestpractical Request Tracker=4.2.10

bestpractical Request Tracker=4.2.11

bestpractical Request Tracker=4.2.12

bestpractical Request Tracker=4.2.13

bestpractical Request Tracker=4.4.0

bestpractical Request Tracker=4.4.1

Event History

Jul 3, 2017

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2017-5361?

CVE-2017-5361 has a medium severity due to its potential to expose sensitive user passwords through timing attacks.

How do I fix CVE-2017-5361?

The recommended fix for CVE-2017-5361 is to upgrade Request Tracker to version 4.0.25, 4.2.14, or 4.4.2 or later.

What versions are affected by CVE-2017-5361?

CVE-2017-5361 affects Request Tracker versions 4.0.x prior to 4.0.25, 4.2.x prior to 4.2.14, and 4.4.x prior to 4.4.2.

What type of attack does CVE-2017-5361 enable?

CVE-2017-5361 enables remote attackers to exploit timing side-channel vulnerabilities to obtain sensitive information.

Is CVE-2017-5361 a local or remote vulnerability?

CVE-2017-5361 is a remote vulnerability, allowing attackers to exploit it without direct access to the server.