Debian alert DLA-3642-1 (request-tracker4)

From:
             
 
Salvatore Bonaccorso <carnil@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 3642-1] request-tracker4 security update
Date:
             
 
Tue, 31 Oct 2023 04:53:47 +0000
Message-ID:
             
 
<E1qxgl9-00FRLR-Q3@seger.debian.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3642-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                 Salvatore Bonaccorso
October 31, 2023                              https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : request-tracker4
Version        : 4.4.3-2+deb10u3
CVE ID         : CVE-2023-41259 CVE-2023-41260
Debian Bug     : 1054516

Multiple vulnerabilities have been discovered in Request Tracker, an
extensible trouble-ticket tracking system.

CVE-2023-41259

    Tom Wolters reported that Request Tracker is vulnerable to accepting
    unvalidated RT email headers in incoming email and the mail-gateway
    REST interface.

CVE-2023-41260

    Tom Wolters reported that Request Tracker is vulnerable to
    information leakage via response messages returned from requests
    sent via the mail-gateway REST interface.

For Debian 10 buster, these problems have been fixed in version
4.4.3-2+deb10u3.

We recommend that you upgrade your request-tracker4 packages.

For the detailed security status of request-tracker4 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/request-tracker4

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmVAiChfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0R7LQ//Q/w9fDj89y743khicNeTcOrhe5GseUNYn+OOH/WmkODojXhR+drwpaj1
iFhPloaXpyQ4V5eYMKK0CgHilSyiQJFTdouqxCrF+hzwR4rPDSFyjABvlwDm2+99
Amz7itUo9JBmHeJziy0UNea0I1yfxSjnEVC9mHC9pJTW3Ghn/JZsiGIQcH12aNGv
cu469VDqIFE/jcAC082SWXsdU2zWFIHtxnxVDxLr62xare7oSYprXX9uAomSEBDw
EMnM00dGBkC50qvsebcil+h+9kOIGBTD0QvUXJzZxeFhk8He0+134+z02Db2O5qU
X1SNLL6ohBxQL4Bcg4vIz4ssC1swOpDp/f2yR2e0Vj9CogCy0Xe8fEE/h5Xv3nyk
agFSTxMRnW0ndwms0BlRGJXyb2kwK9CmyHOcDaSRTRqs+TmQSAa8SOv/CbREylPR
uZFkIJCkkUjE2WYCegw1iz8t4rDCmQSpIWhq4v9CglMLBmr6trMoWik+HmXtAHIN
FDwLe3ZegaPhnRitt+/RgWA3hSfzxXWy/r6KyS1kYi4RhXtKVv8Zmbnm3M9GSPMg
GmwdHHdri6Qc0z73uGiyA1+l+vjOMY/dh2v49jhFiB6LWJbdIrVMGsXYUXmt0Nkf
UELqJFbI703TOQaDJO2TCRBSxHBC5PXXcv2vbfgAqu+G/M9Wh9w=
=0a8h
-----END PGP SIGNATURE-----