USN-6529-1: Request Tracker vulnerabilities
Published Dec 4, 2023
·Updated
It was discovered that Request Tracker incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to obtain sensitive information. (CVE-2021-38562, CVE-2022-25802, CVE-2023-41259, CVE-2023-41260)
Affected Software
80 affected componentsFixes available
All of the following
ubuntu/request-tracker4<4.4.4+dfsg-2ubuntu1.23.10.1
4.4.4+dfsg-2ubuntu1.23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/rt4-apache2<4.4.4+dfsg-2ubuntu1.23.10.1
4.4.4+dfsg-2ubuntu1.23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/rt4-clients<4.4.4+dfsg-2ubuntu1.23.10.1
4.4.4+dfsg-2ubuntu1.23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/rt4-db-mysql<4.4.4+dfsg-2ubuntu1.23.10.1
4.4.4+dfsg-2ubuntu1.23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/rt4-db-postgresql<4.4.4+dfsg-2ubuntu1.23.10.1
4.4.4+dfsg-2ubuntu1.23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/rt4-db-sqlite<4.4.4+dfsg-2ubuntu1.23.10.1
4.4.4+dfsg-2ubuntu1.23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/rt4-fcgi<4.4.4+dfsg-2ubuntu1.23.10.1
4.4.4+dfsg-2ubuntu1.23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/rt4-standalone<4.4.4+dfsg-2ubuntu1.23.10.1
4.4.4+dfsg-2ubuntu1.23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/request-tracker4<4.4.4+dfsg-2ubuntu1.23.04.1
4.4.4+dfsg-2ubuntu1.23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/rt4-apache2<4.4.4+dfsg-2ubuntu1.23.04.1
4.4.4+dfsg-2ubuntu1.23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/rt4-clients<4.4.4+dfsg-2ubuntu1.23.04.1
4.4.4+dfsg-2ubuntu1.23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/rt4-db-mysql<4.4.4+dfsg-2ubuntu1.23.04.1
4.4.4+dfsg-2ubuntu1.23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/rt4-db-postgresql<4.4.4+dfsg-2ubuntu1.23.04.1
4.4.4+dfsg-2ubuntu1.23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/rt4-db-sqlite<4.4.4+dfsg-2ubuntu1.23.04.1
4.4.4+dfsg-2ubuntu1.23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/rt4-fcgi<4.4.4+dfsg-2ubuntu1.23.04.1
4.4.4+dfsg-2ubuntu1.23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/rt4-standalone<4.4.4+dfsg-2ubuntu1.23.04.1
4.4.4+dfsg-2ubuntu1.23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/request-tracker4<4.4.4+dfsg-2ubuntu1.22.04.1
4.4.4+dfsg-2ubuntu1.22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/rt4-apache2<4.4.4+dfsg-2ubuntu1.22.04.1
4.4.4+dfsg-2ubuntu1.22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/rt4-clients<4.4.4+dfsg-2ubuntu1.22.04.1
4.4.4+dfsg-2ubuntu1.22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/rt4-db-mysql<4.4.4+dfsg-2ubuntu1.22.04.1
4.4.4+dfsg-2ubuntu1.22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/rt4-db-postgresql<4.4.4+dfsg-2ubuntu1.22.04.1
4.4.4+dfsg-2ubuntu1.22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/rt4-db-sqlite<4.4.4+dfsg-2ubuntu1.22.04.1
4.4.4+dfsg-2ubuntu1.22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/rt4-fcgi<4.4.4+dfsg-2ubuntu1.22.04.1
4.4.4+dfsg-2ubuntu1.22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/rt4-standalone<4.4.4+dfsg-2ubuntu1.22.04.1
4.4.4+dfsg-2ubuntu1.22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/request-tracker4<4.4.3-2+deb10u3build0.20.04.1
4.4.3-2+deb10u3build0.20.04.1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/rt4-apache2<4.4.3-2+deb10u3build0.20.04.1
4.4.3-2+deb10u3build0.20.04.1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/rt4-clients<4.4.3-2+deb10u3build0.20.04.1
4.4.3-2+deb10u3build0.20.04.1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/rt4-db-mysql<4.4.3-2+deb10u3build0.20.04.1
4.4.3-2+deb10u3build0.20.04.1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/rt4-db-postgresql<4.4.3-2+deb10u3build0.20.04.1
4.4.3-2+deb10u3build0.20.04.1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/rt4-db-sqlite<4.4.3-2+deb10u3build0.20.04.1
4.4.3-2+deb10u3build0.20.04.1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/rt4-fcgi<4.4.3-2+deb10u3build0.20.04.1
4.4.3-2+deb10u3build0.20.04.1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/rt4-standalone<4.4.3-2+deb10u3build0.20.04.1
4.4.3-2+deb10u3build0.20.04.1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/request-tracker4<4.4.2-2ubuntu0.1~esm1
4.4.2-2ubuntu0.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/rt4-apache2<4.4.2-2ubuntu0.1~esm1
4.4.2-2ubuntu0.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/rt4-clients<4.4.2-2ubuntu0.1~esm1
4.4.2-2ubuntu0.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/rt4-db-mysql<4.4.2-2ubuntu0.1~esm1
4.4.2-2ubuntu0.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/rt4-db-postgresql<4.4.2-2ubuntu0.1~esm1
4.4.2-2ubuntu0.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/rt4-db-sqlite<4.4.2-2ubuntu0.1~esm1
4.4.2-2ubuntu0.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/rt4-fcgi<4.4.2-2ubuntu0.1~esm1
4.4.2-2ubuntu0.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/rt4-standalone<4.4.2-2ubuntu0.1~esm1
4.4.2-2ubuntu0.1~esm1
Ubuntu Ubuntu=18.04
Event History
Dec 4, 2023
Advisory Published
12:00 AM
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
1
What is the severity of USN-6529-1?
USN-6529-1 is classified as a medium severity vulnerability that allows potential access to sensitive information.
2
How do I fix USN-6529-1?
To fix USN-6529-1, upgrade to the affected packages which are version 4.4.4+dfsg-2ubuntu1.23.04.1 or newer.
3
Which versions are affected by USN-6529-1?
USN-6529-1 affects Request Tracker versions prior to 4.4.4+dfsg-2ubuntu1.23.10.1.
4
What products are impacted by USN-6529-1?
USN-6529-1 impacts multiple Ubuntu products running Request Tracker, such as Ubuntu 18.04, 20.04, and 23.04.
5
Can USN-6529-1 be exploited remotely?
Yes, if a user is tricked into opening a specially crafted input file, a remote attacker could exploit USN-6529-1.