Your message dated Sat, 04 Nov 2023 12:47:14 +0000
with message-id <[email protected]>
and subject line Bug#1054517: fixed in request-tracker5 5.0.3+dfsg-3~deb12u2
has caused the Debian Bug report #1054517,
regarding request-tracker5: CVE-2023-41259 CVE-2023-41260 CVE-2023-45024
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1054517: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054517
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: request-tracker5
Version: 5.0.4+dfsg-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Control: found -1 5.0.3+dfsg-3~deb12u1
Control: found -1 5.0.3+dfsg-1
Hi Andrew, Dominic, Niko
The following vulnerabilities were published for request-tracker5.
Filling it in BTS for visiblity there, and for tracking status in the
various suites.
CVE-2023-41259[0]:
| RT is vulnerable to accepting unvalidated RT email headers in
| incoming email and the mail-gateway REST interface. This vulnerability
| is assigned CVE-2023-41259.
CVE-2023-41260[1]:
| RT is vulnerable to information leakage via response messages returned
| from requests sent via the mail-gateway REST interface. This vulnerability
| is assigned CVE-2023-41260.
CVE-2023-45024[2]:
| RT 5.0 is vulnerable to information leakage via transaction searches made by
| authenticated users in the transaction query builder. This vulnerability is
| assigned CVE-2023-45024. Thanks to edk and bakerst of Libera Chat for
reporting
| this finding.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2023-41259
https://www.cve.org/CVERecord?id=CVE-2023-41259
[1] https://security-tracker.debian.org/tracker/CVE-2023-41260
https://www.cve.org/CVERecord?id=CVE-2023-41260
[2] https://security-tracker.debian.org/tracker/CVE-2023-45024
https://www.cve.org/CVERecord?id=CVE-2023-45024
[3] https://github.com/bestpractical/rt/releases/tag/rt-5.0.5
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: request-tracker5
Source-Version: 5.0.3+dfsg-3~deb12u2
Done: Andrew Ruthven <[email protected]>
We believe that the bug you reported is fixed in the latest version of
request-tracker5, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Andrew Ruthven <[email protected]> (supplier of updated request-tracker5
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Wed, 25 Oct 2023 22:26:55 +1300
Source: request-tracker5
Architecture: source
Version: 5.0.3+dfsg-3~deb12u2
Distribution: bookworm-security
Urgency: medium
Maintainer: Andrew Ruthven <[email protected]>
Changed-By: Andrew Ruthven <[email protected]>
Closes: 1054517
Changes:
request-tracker5 (5.0.3+dfsg-3~deb12u2) bookworm-security; urgency=medium
.
* Apply upstream patch which fixes several security vulnerabilities
(Closes: #1054517).
- [CVE-2023-41259] Vulnerablility to unvalidated email headers in
incoming email and the mail-gateway REST interface.
- [CVE-2023-41620] Information leakage via response messages returned
from requests sent via the mail-gateway REST interface.
- [CVE-2023-45024] Information leakage via transaction searches made by
authenticated users in the transaction query builder.
- Reveal information about data on various RT objects in errors and other
response messages to REST 2 requests.
* Add upstream fix to tests for FTBFS due to expired certs.
Checksums-Sha1:
cdc312f25dc033bf49af2fff29bdd4748fed5fb6 6209
request-tracker5_5.0.3+dfsg-3~deb12u2.dsc
ef0b663b6363cabf3845f7f6bd5b508d66b0929e 3217706
request-tracker5_5.0.3+dfsg.orig-third-party-source.tar.gz
4f043bd95000923aa8189403b73f52b720c534de 18601901
request-tracker5_5.0.3+dfsg.orig.tar.gz
307b425a830f9ff3df679e2d365a02a8c566bdcb 455
request-tracker5_5.0.3+dfsg.orig.tar.gz.asc
6480d63d9a35346ded583ff33d9bf183684d3bd1 162216
request-tracker5_5.0.3+dfsg-3~deb12u2.debian.tar.xz
5aa286d0c12a22a2fc7cfaca9ce9b1dc72796e63 23916
request-tracker5_5.0.3+dfsg-3~deb12u2_amd64.buildinfo
Checksums-Sha256:
cbb6a74e3387753f7136d961fbdf7813ebf889463a56e171582f49becaf6ae2d 6209
request-tracker5_5.0.3+dfsg-3~deb12u2.dsc
49b856ff23be2f5265c7b3460ac3d49ef24e4462b8165d39fbb12b7776d0e66a 3217706
request-tracker5_5.0.3+dfsg.orig-third-party-source.tar.gz
e23aee3cb291ccad5e521aeabe0fcd2f076bcfa8b7f801af498a7505e53d8441 18601901
request-tracker5_5.0.3+dfsg.orig.tar.gz
6cfc32a9bf2d09768a5ac2b103f21d6675dfc3490c06190562296e5b2082ccce 455
request-tracker5_5.0.3+dfsg.orig.tar.gz.asc
0f24c6e744fa8be92842fedd14f9dd3e670bc33593a77eb1440a848ab7580095 162216
request-tracker5_5.0.3+dfsg-3~deb12u2.debian.tar.xz
6703816fa83d57d670a2a24ad471c8a4f71fb96d1d6f93ca356495cbec4af286 23916
request-tracker5_5.0.3+dfsg-3~deb12u2_amd64.buildinfo
Files:
4bb9137e3d4dcafebfc5991ee7bdf09a 6209 misc optional
request-tracker5_5.0.3+dfsg-3~deb12u2.dsc
7e052f0715b42102e6387f6e398a6e87 3217706 misc optional
request-tracker5_5.0.3+dfsg.orig-third-party-source.tar.gz
ec8a8fc2fbbf1ccebb4825ca0e2aeac5 18601901 misc optional
request-tracker5_5.0.3+dfsg.orig.tar.gz
f52489a073fb418b7bc68a6bb672299e 455 misc optional
request-tracker5_5.0.3+dfsg.orig.tar.gz.asc
609f0c35a0a02a5215fd8a7ec0994cd8 162216 misc optional
request-tracker5_5.0.3+dfsg-3~deb12u2.debian.tar.xz
ed81b9680d57dbd50b5a98ff6fcd22c0 23916 misc optional
request-tracker5_5.0.3+dfsg-3~deb12u2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEExgP8TmAPHOzRyNl8S1PZMeTT6GMFAmU/dRMACgkQS1PZMeTT
6GNMRQ//aY2zzTUyOFU/2zoEE4+ZilA2TJkHuipIHVkK6B4una8iXW66eWzUZmoq
h6/q8X/lFOWRFFemnuPvDhJfPSE8xFvbL6uPJKc+jY8POk2vnRRRJm281e5PDQQe
4TmH9e0b006ZsHXzaO0VeeAm8hIoINmU550biPyrTUoF/DHdaTFCKNjvxKBShV9R
RWqfz2DSlVBqmzFlBh6yzuAIgmVreMldIpziNoT04RUywYZV71GjmAVnqN2j37gW
4g9g1cFZdCmeq6Yh8GitVVuJAZhRbGnOVKA2C6dsk3ombhjMtAtbLMh756K3n74/
4ZimizOXfPGZlq49ek4u/BefsO27aypuTu3BnFBRVOe7mRFGEKCgO9yqRgT5D+6l
HQWBBR1PvHp1LP/K4cpgjAtEIhz0EqqubKVcEVPV0Ko5ETDvI30bHixIz6+V6hUR
nIA4tUMzTXzWcmWD4z/rx1huD62tOamLWMGoNUEdj6YhEpeoGn/yGufkUyyFBxIo
7KNG8rYdUpGGNnQNeww1pt/f/uWq7HKq8qdTiOX5Gj3lJRDuiYSZoi9G1imAxi4K
H7GN1jUrmlrrrdbhZUbqdbBTjno9ToSGVziWna1LNBulCH89+KntB/ct9yMfrLxS
aszupcy3ptWLvaL7BknXFKzv7aZCAnYVbArX+UbSoN6fvfYqY2g=
=jboz
-----END PGP SIGNATURE-----
--- End Message ---
