Security Update for Request Tracker 4
Summary
DSA-3176-1: request-tracker4 - security update. Affects request-tracker4 versions < 4.0.7-5+deb7u3. Fixed in 4.0.7-5+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Request Tracker is an extensible trouble-ticket tracking system used for managing and tracking customer support requests. It allows organizations to efficiently handle and resolve customer issues. However, multiple vulnerabilities have been discovered in Request Tracker, making it susceptible to various attacks.
Vulnerability Detail
The identified vulnerabilities in Request Tracker are as follows:
-
CVE-2014-9472: This vulnerability allows remote attackers to launch a denial of service attack by exploiting the email gateway. It can result in excessive CPU and disk usage.
-
CVE-2015-1165: This vulnerability exposes RSS feed URLs, potentially revealing sensitive ticket data.
-
CVE-2015-1464: RSS feed URLs can be leveraged to perform session hijacking, enabling unauthorized access as the user who created the feed.
How To Fix
Minimum fixed version
4.0.7-5+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade request-tracker4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workarounds have been mentioned for these vulnerabilities. It is crucial to apply the recommended package upgrades to ensure the security of the system.
Conclusion
Request Tracker 4 has been found to have multiple vulnerabilities, including denial of service, information disclosure, and session hijacking. It is crucial to upgrade the package to the recommended versions to mitigate these risks. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for request-tracker4 →
FAQ
Request Tracker is an extensible trouble-ticket tracking system used for managing and tracking customer support requests.
CVE-2014-9472 allows remote attackers to launch a denial of service attack, potentially causing excessive CPU and disk usage.
CVE-2015-1165 exposes RSS feed URLs, which can potentially reveal sensitive ticket data.
CVE-2015-1464 allows session hijacking, enabling unauthorized access as the user who created the RSS feed.
To fix these vulnerabilities, upgrade the request-tracker4 package to the recommended versions mentioned in the 'how_to_fix' section.
Related vulnerabilities
Recent vulnerabilities recorded for request-tracker4.
