CVE-2021-38562: High severity bestpractical Request Tracker vulnerability
Published Oct 18, 2021
·Updated
Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm.
Affected Software
18 affected componentsFixes available
ubuntu/request-tracker5<5.0.2
5.0.2
ubuntu/request-tracker4<4.4.2-2ubuntu0.1~
4.4.2-2ubuntu0.1~
ubuntu/request-tracker4<4.4.3-2+
4.4.3-2+
ubuntu/request-tracker4<4.4.4+dfsg-2ubuntu1.22.04.1
4.4.4+dfsg-2ubuntu1.22.04.1
ubuntu/request-tracker4<4.4.4+dfsg-2ubuntu1.23.04.1
4.4.4+dfsg-2ubuntu1.23.04.1
ubuntu/request-tracker4<4.4.4+dfsg-2ubuntu1.23.10.1
4.4.4+dfsg-2ubuntu1.23.10.1
debian/request-tracker4
4.4.3-2+deb10u24.4.3-2+deb10u34.4.4+dfsg-2+deb11u24.4.4+dfsg-2+deb11u34.4.6+dfsg-1.1+deb12u14.4.7+dfsg-1
debian/request-tracker5
5.0.3+dfsg-3~deb12u25.0.5+dfsg-2
bestpractical Request Tracker>=4.2.0<4.2.17
bestpractical Request Tracker>=4.4.0<4.4.5
bestpractical Request Tracker>=5.0.0<5.0.2
Fedoraproject Fedora=35
Debian Debian Linux=9.0
alpine/rt4<4.4.7-r0
4.4.7-r0
alpine/rt4<4.4.7-r0
4.4.7-r0
alpine/rt4<4.4.7-r0
4.4.7-r0
alpine/rt4<4.4.7-r0
4.4.7-r0
alpine/rt4<4.4.7-r0
4.4.7-r0
Remediation
Event History
Oct 18, 2021
CVE Published
12:00 AM
CVE Published
via MITRE·08:52 AM
Data Sourced
via MITRE·08:52 AM
Description
Data Sourced
via NVD·09:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·09:15 AM
DescriptionSeverityAffected Software