CVE-2025-2545: Deprecated 3DES cryptographic algorithm used by Request Tracker in emails encrypted with S/MIME
Vulnerability in Best Practical Solutions, LLC's Request Tracker prior to v5.0.8, where the Triple DES (3DES) cryptographic algorithm is used to protect emails sent with S/MIME encryption. Triple DES is considered obsolete and insecure due to its susceptibility to birthday attacks, which could compromise the confidentiality of encrypted messages.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2545?
CVE-2025-2545 is considered a high severity vulnerability due to its exploitation potential related to obsolete cryptographic practices.
How do I fix CVE-2025-2545?
To fix CVE-2025-2545, upgrade to a version of Request Tracker that uses stronger, recommended encryption algorithms.
What impact does CVE-2025-2545 have on my data security?
CVE-2025-2545 can lead to unauthorized access to encrypted S/MIME emails, compromising the confidentiality of sensitive information.
Which versions of Request Tracker are affected by CVE-2025-2545?
CVE-2025-2545 affects Best Practical Solutions' Request Tracker version 5.0.7 where Triple DES is utilized.
Is Triple DES encryption still safe to use as per CVE-2025-2545?
No, as stated in CVE-2025-2545, Triple DES is considered obsolete and is subject to vulnerabilities such as birthday attacks.