Security Update for Request Tracker 4
Summary
DSA-3882-1: request-tracker4 - security update. Affects request-tracker4 versions < 4.4.1-3+deb9u1. Fixed in 4.4.1-3+deb9u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Request Tracker is an extensible trouble-ticket tracking system used for managing and tracking customer support issues. It allows organizations to efficiently handle and resolve customer inquiries and problems. However, multiple vulnerabilities have been discovered in Request Tracker, making it susceptible to various attacks.
Vulnerability Detail
The identified vulnerabilities in Request Tracker include:
-
Cross-Site Scripting (XSS) Attack (CVE-2016-6127): Request Tracker is vulnerable to XSS attacks if a malicious file with a specific content type is uploaded. This issue can be mitigated by enabling the AlwaysDownloadAttachments config setting.
-
Timing Side-Channel Attacks for User Passwords (CVE-2017-5361): Request Tracker is susceptible to timing side-channel attacks, which can potentially expose user passwords.
-
Information Leak of CSRF Verification Tokens (CVE-2017-5943): Request Tracker can leak CSRF verification tokens if a user is tricked into visiting a specially crafted URL by an attacker.
-
Remote Code Execution Vulnerability in Dashboard Subscription Interface (CVE-2017-5944): Request Tracker is prone to a remote code execution vulnerability in the dashboard subscription interface. An attacker with sufficient privileges can exploit this flaw by using carefully-crafted saved search names to execute unexpected code.
Additionally, this update also addresses a denial of service vulnerability (CVE-2015-7686) in Email::Address, which could impact the functionality of Request Tracker.
How To Fix
Minimum fixed version
4.4.1-3+deb9u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade request-tracker4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately upgrade to the fixed versions, you can mitigate the XSS vulnerability (CVE-2016-6127) by enabling the AlwaysDownloadAttachments config setting. However, it is strongly recommended to apply the official fix as soon as possible to ensure comprehensive security.
Conclusion
Request Tracker is vulnerable to multiple security issues, including XSS attacks, timing side-channel attacks, information leaks, and remote code execution. To protect your installation, it is crucial to upgrade to the fixed versions as soon as possible. If you are unable to upgrade immediately, enabling the AlwaysDownloadAttachments config setting can mitigate the XSS vulnerability temporarily. For further assistance and support in addressing these vulnerabilities, please contact DevNack.com.
See every vulnerability recorded for request-tracker4 →
FAQ
Request Tracker is an extensible trouble-ticket tracking system used for managing and tracking customer support issues.
Cross-site scripting (XSS) is a type of security vulnerability where an attacker injects malicious scripts into web pages viewed by other users. In the case of Request Tracker, an attacker can exploit this vulnerability by uploading a malicious file with a specific content type.
To protect against timing side-channel attacks, it is crucial to ensure that your Request Tracker installation is always up to date with the latest security patches. Additionally, implementing strong password policies and encouraging users to choose complex passwords can also help mitigate the risk.
CSRF verification tokens are used to protect against cross-site request forgery attacks. They are unique tokens generated by the server and included in each request to verify the authenticity of the request. In the case of Request Tracker, an attacker can exploit a vulnerability to leak these tokens, potentially allowing them to perform unauthorized actions on behalf of the user.
To prevent remote code execution in the dashboard subscription interface, it is essential to apply the provided fix by upgrading to the recommended versions of Request Tracker. This fix addresses the vulnerability and ensures that unexpected code execution cannot occur.
Related vulnerabilities
Recent vulnerabilities recorded for request-tracker4.
