Ubuntu alert USN-8506-1 (request-tracker5)
| From: | noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-8506-1] Request Tracker vulnerabilities | |
| Date: | Mon, 06 Jul 2026 13:16:13 +0000 | |
| Message-ID: | <E1wgjBF-0002Li-VK@lists.ubuntu.com> | |
| Cc: | noreply+usn-bot@canonical.com |
========================================================================== Ubuntu Security Notice USN-8506-1 July 06, 2026 request-tracker5 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Several security issues were fixed in Request Tracker. Software Description: - request-tracker5: extensible trouble-ticket tracking system Details: Aleksander Iwicki discovered that Request Tracker did not properly sanitize the search "Page" URL parameter. A remote attacker could possibly use this issue to conduct a reflected cross-site scripting attack. (CVE-2026-6841) It was discovered that Request Tracker did not properly sanitize user- controlled data written to spreadsheet exports of search results. A remote attacker could possibly use this issue to conduct a spreadsheet (CSV/formula) injection attack, causing spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. (CVE-2026-41073) It was discovered that Request Tracker did not properly validate input incorporated into database queries via the entry_aggregator parameter in JSON search. An authenticated user could possibly use this issue to perform SQL injection attacks and read or modify data in the RT database. (CVE-2026-41075) It was discovered that Request Tracker contained an authentication bypass when configured to authenticate users against an LDAP or Active Directory server. Under certain LDAP server configurations, a remote attacker could possibly use this issue to authenticate as any LDAP-backed RT user without supplying valid credentials. (CVE-2026-41076) It was discovered that Request Tracker served certain uploaded content inline rather than as an attachment. A remote attacker could possibly use this issue to conduct a cross-site scripting attack. (CVE-2026-44229) It was discovered that Request Tracker did not properly sanitize input on search-results chart pages. A remote attacker could possibly use this issue to conduct a reflected cross-site scripting attack. (CVE-2026-44230) Jeroen Gui discovered that Request Tracker did not properly restrict access to the REST 2.0 user collection endpoint. A privileged user could possibly use this issue to obtain authentication credentials belonging to other users, including administrators, resulting in privilege escalation and information disclosure. (CVE-2026-44231) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS request-tracker5 5.0.7+dfsg-6ubuntu0.1~esm1 Available with Ubuntu Pro rt5-apache2 5.0.7+dfsg-6ubuntu0.1~esm1 Available with Ubuntu Pro rt5-clients 5.0.7+dfsg-6ubuntu0.1~esm1 Available with Ubuntu Pro rt5-db-mysql 5.0.7+dfsg-6ubuntu0.1~esm1 Available with Ubuntu Pro rt5-db-postgresql 5.0.7+dfsg-6ubuntu0.1~esm1 Available with Ubuntu Pro rt5-db-sqlite 5.0.7+dfsg-6ubuntu0.1~esm1 Available with Ubuntu Pro rt5-fcgi 5.0.7+dfsg-6ubuntu0.1~esm1 Available with Ubuntu Pro rt5-standalone 5.0.7+dfsg-6ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 24.04 LTS request-tracker5 5.0.5+dfsg-2ubuntu0.1~esm2 Available with Ubuntu Pro rt5-apache2 5.0.5+dfsg-2ubuntu0.1~esm2 Available with Ubuntu Pro rt5-clients 5.0.5+dfsg-2ubuntu0.1~esm2 Available with Ubuntu Pro rt5-db-mysql 5.0.5+dfsg-2ubuntu0.1~esm2 Available with Ubuntu Pro rt5-db-postgresql 5.0.5+dfsg-2ubuntu0.1~esm2 Available with Ubuntu Pro rt5-db-sqlite 5.0.5+dfsg-2ubuntu0.1~esm2 Available with Ubuntu Pro rt5-fcgi 5.0.5+dfsg-2ubuntu0.1~esm2 Available with Ubuntu Pro rt5-standalone 5.0.5+dfsg-2ubuntu0.1~esm2 Available with Ubuntu Pro Ubuntu 22.04 LTS request-tracker5 5.0.1+dfsg-1ubuntu1+esm2 Available with Ubuntu Pro rt5-apache2 5.0.1+dfsg-1ubuntu1+esm2 Available with Ubuntu Pro rt5-clients 5.0.1+dfsg-1ubuntu1+esm2 Available with Ubuntu Pro rt5-db-mysql 5.0.1+dfsg-1ubuntu1+esm2 Available with Ubuntu Pro rt5-db-postgresql 5.0.1+dfsg-1ubuntu1+esm2 Available with Ubuntu Pro rt5-db-sqlite 5.0.1+dfsg-1ubuntu1+esm2 Available with Ubuntu Pro rt5-fcgi 5.0.1+dfsg-1ubuntu1+esm2 Available with Ubuntu Pro rt5-standalone 5.0.1+dfsg-1ubuntu1+esm2 Available with Ubuntu Pro After a standard system update you need to restart request-tracker5 to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8506-1 CVE-2026-41073, CVE-2026-41075, CVE-2026-41076, CVE-2026-44229, CVE-2026-44230, CVE-2026-44231, CVE-2026-6841
Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmpLqhQACgkQcpJm3tlz hgHfxw/9EsZsnfeqQ6ynpYA4btGmF/hja0qWocHDJEfjnrl3UIhwNnK6omgRQ2B+ xqWy+6700yw+fTp8xSO4PlXyuUanWt5fuTDp/zeYEY31oDSPk7NOrDXAXFAZsUFZ ndgoRKneh+nlemKSNdcdQn6n/vEINnHLUUwCEBny+xQBsC+0UVfeFHRC91QkRM8l jUz61F2kDHaLnRhAUkTLQXqj7RnqHioHF1Jq0WV++xS2ID9EAYKqtpj4P4MG5BJc K4SeMzFTbUAv1w5525BiAeWbVf+MSB82i9qhVfI7ftf8SCYlPsuIL/lv28HBmdR2 RGQkDQlfn1vBknEN5YgxQ4tduZtaO5sPFpDTvjktdBxLcMFNULPqAwkGaXkz726e 9m/D7UbPv7xMvoW5HqgKsWidBP5e7gtABE89aAbnkbYqBMmzsywS08B/fM+nXWS7 bmX0HAXbqQuPx4T2z/uC3G6TgFHOmirYJQKU/VZxCH+BvPW3/lH/RWey9gO0aOQj iTIrzbS2WCpJkC7WdtNr42seLr3REJoa99O6TUqhC/NnKocFHHvngeicF9lVq+TI 6jWo82Ud8xMYT4KbVHSmA0httmH3QwFGUt1wYqQz2D+p8mITPx52IUNr1n59YXQQ 675EpLcGxtdtYpZQ/kN69LZDwa9HL4oAskAZBJP5U/oQOswJBIQ= =K1Ie -----END PGP SIGNATURE-----