Critical Vulnerabilities in Request Tracker 5: Security Risks and Mitigation Strategies
Summary
USN-7692-1: request-tracker5 vulnerabilities. Affects request-tracker5 versions < 5.0.1+dfsg-1ubuntu1+esm1. Fixed in 5.0.1+dfsg-1ubuntu1+esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Request Tracker (RT) is a robust ticketing system widely used for managing tasks and issues in various organizations. It provides functionalities such as tracking requests, managing workflows, and facilitating communication among team members. However, recent vulnerabilities have been identified in RT 5, specifically affecting versions 5.0.1+dfsg-1ubuntu1+esm1, 5.0.5+dfsg-2ubuntu0.1~esm1, and 5.0.7+dfsg-2ubuntu0.1, which could lead to significant security risks, including information leakage and denial of service.
Vulnerability Detail
The vulnerabilities stem from various security flaws, including susceptibility to timing attacks, cross-site scripting (XSS) attacks, and improper handling of user data. These issues could allow attackers to access sensitive information, execute arbitrary code, or cause denial of service. Specific vulnerabilities include CVE-2021-38562, CVE-2022-25802, CVE-2022-25803, CVE-2023-41259, CVE-2023-41260, CVE-2023-45024, CVE-2024-3262, CVE-2025-2545, CVE-2025-30087, CVE-2025-31500, and CVE-2025-31501, affecting Ubuntu 22.04 LTS and 24.04 LTS.
How To Fix
Minimum fixed version
5.0.1+dfsg-1ubuntu1+esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade request-tracker5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the Request Tracker application and monitor for any suspicious activities. Additionally, disabling certain features that allow file uploads or external links may mitigate some risks until the patch is applied.
Conclusion
The vulnerabilities in Request Tracker 5 pose significant security risks that require immediate attention. Users are urged to update their installations to the latest patched versions to mitigate these risks. Utilizing tools like Vulert can help monitor for vulnerabilities and ensure the security of open-source software.
See every vulnerability recorded for request-tracker5 →
FAQ
Request Tracker is a ticketing system used for managing tasks and issues, facilitating communication and workflow management within organizations.
The main vulnerabilities include timing attacks, cross-site scripting, improper user data handling, and information leakage, which could lead to unauthorized access and denial of service.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected without needing to sign up.
If immediate updates are not possible, consider implementing workarounds such as restricting access to the application and disabling features that may expose vulnerabilities.
Detailed information about the vulnerabilities can be found in the Ubuntu Security Notices and the Common Vulnerabilities and Exposures (CVE) database.
Related vulnerabilities
Recent vulnerabilities recorded for request-tracker5.
