CVE-2021-38562: High severity request tracker vulnerability
Published Oct 18, 2021
·Updated
Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm.
Affected Software
13 affected componentsFixes available
ubuntu/request-tracker5<5.0.2
5.0.2
ubuntu/request-tracker4<4.4.2-2ubuntu0.1~
4.4.2-2ubuntu0.1~
ubuntu/request-tracker4<4.4.3-2+
4.4.3-2+
ubuntu/request-tracker4<4.4.4+dfsg-2ubuntu1.22.04.1
4.4.4+dfsg-2ubuntu1.22.04.1
ubuntu/request-tracker4<4.4.4+dfsg-2ubuntu1.23.04.1
4.4.4+dfsg-2ubuntu1.23.04.1
ubuntu/request-tracker4<4.4.4+dfsg-2ubuntu1.23.10.1
4.4.4+dfsg-2ubuntu1.23.10.1
debian/request-tracker4
4.4.3-2+deb10u24.4.3-2+deb10u34.4.4+dfsg-2+deb11u24.4.4+dfsg-2+deb11u34.4.6+dfsg-1.1+deb12u14.4.7+dfsg-1
debian/request-tracker5
5.0.3+dfsg-3~deb12u25.0.5+dfsg-2
bestpractical Request Tracker>=4.2.0<4.2.17
bestpractical Request Tracker>=4.4.0<4.4.5
bestpractical Request Tracker>=5.0.0<5.0.2
Fedoraproject Fedora=35
Debian Debian Linux=9.0
Remediation
Event History
Oct 18, 2021
CVE Published
12:00 AM
CVE Published
via MITRE·08:52 AM
Data Sourced
via MITRE·08:52 AM
Description
Dec 4, 2023
Data Sourced
09:08 PM
Description