Critical Security Update for Request Tracker 5: Addressing Multiple Vulnerabilities
Summary
DSA-5909-1: request-tracker5 - security update. Affects request-tracker5 versions < 5.0.3+dfsg-3~deb12u3. Fixed in 5.0.3+dfsg-3~deb12u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Request Tracker 5 (RT5) is a widely used open-source ticketing system that helps organizations manage tasks and requests efficiently. It provides features such as custom workflows, user management, and reporting capabilities. However, like many software applications, it is susceptible to security vulnerabilities that can compromise its integrity and the data it manages.
Vulnerability Detail
The vulnerabilities identified in Request Tracker 5 include several critical issues, such as CVE-2024-3262, CVE-2025-2545, CVE-2025-30087, CVE-2025-31500, and CVE-2025-31501. These vulnerabilities could allow unauthorized access, data leakage, or even remote code execution, posing significant risks to users and organizations relying on this software. The vulnerabilities stem from improper input validation and insufficient access controls, which could be exploited by malicious actors.
How To Fix
Minimum fixed version
5.0.3+dfsg-3~deb12u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade request-tracker5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Request Tracker application by implementing stricter firewall rules or by limiting user permissions until the update can be applied. This can help mitigate the risk of exploitation while awaiting the official patch.
Conclusion
The vulnerabilities in Request Tracker 5 pose significant risks that can affect the security and integrity of the systems using this software. It is crucial for users to apply the necessary updates promptly and consider temporary workarounds to mitigate risks until the updates are implemented.
See every vulnerability recorded for request-tracker5 →
FAQ
The main vulnerabilities include CVE-2024-3262, CVE-2025-2545, CVE-2025-30087, CVE-2025-31500, and CVE-2025-31501, which could lead to unauthorized access and data breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If you cannot update immediately, consider implementing stricter access controls and firewall rules as a temporary workaround to mitigate risks.
Detailed information about the vulnerabilities can be found in the Debian security advisory DSA-5909-1 and the associated CVE entries.
Updating to the latest version is generally safe, but it is always recommended to back up your data before performing any updates to avoid potential data loss.
Related vulnerabilities
Recent vulnerabilities recorded for request-tracker5.
