CVE-2020-1774: Information disclosure
First published: Tue Apr 28 2020(Updated: )
When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix them and to send private key to the third-party instead of public key. This issue affects ((OTRS)) Community Edition: 5.0.42 and prior versions, 6.0.27 and prior versions. OTRS: 7.0.16 and prior versions.
Credit: security@otrs.com security@otrs.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Otrs Otrs | >=5.0.0<=5.0.42 | |
| Otrs Otrs | >=6.0.0<=6.0.27 | |
| Otrs Otrs | >=7.0.0<=7.0.16 | |
| Debian Debian Linux | =8.0 |
Remedy
Upgrade to OTRS 7.0.17, ((OTRS)) Community Edition 6.0.28 Patch for ((OTRS)) Community Edition 6: https://github.com/OTRS/otrs/commit/ff725cbea77f03fa296bb13f93f5b07086920342 Patch for ((OTRS)) Community Edition 5: https://github.com/OTRS/otrs/commit/fb0e6131e79aa2ba9c7acbd16f4ee4e73289f64b
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-1774?
CVE-2020-1774 is a vulnerability that affects ((OTRS)) Community Edition versions 5.0.42 and prior, and 6.0.27 and prior. It allows for the mixing of private and public keys when downloading PGP or S/MIME keys/certificates.
What is the severity of CVE-2020-1774?
CVE-2020-1774 has a severity rating of 4.9 (medium).
How does CVE-2020-1774 affect ((OTRS)) Community Edition?
CVE-2020-1774 affects ((OTRS)) Community Edition versions 5.0.42 and prior, and 6.0.27 and prior. It allows for the mixing of private and public keys when downloading PGP or S/MIME keys/certificates.
How can I fix CVE-2020-1774?
To fix CVE-2020-1774, upgrade to a version of ((OTRS)) Community Edition that is not affected by this vulnerability.
Where can I find more information about CVE-2020-1774?
More information about CVE-2020-1774 can be found in the following references: [Reference 1](https://lists.debian.org/debian-lts-announce/2020/05/msg00000.html), [Reference 2](https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html), [Reference 3](https://otrs.com/release-notes/otrs-security-advisory-2020-11/).
- collector/nvd-api
- collector/nvd-index
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/remedy
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/otrs
- canonical/otrs otrs
- version/otrs otrs/5.0.0
- version/otrs otrs/5.0.42
- version/otrs otrs/6.0.0
- version/otrs otrs/6.0.27
- version/otrs otrs/7.0.0
- version/otrs otrs/7.0.16
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0