Your message dated Tue, 07 Nov 2023 21:18:08 +0000
with message-id <[email protected]>
and subject line Bug#1054516: fixed in request-tracker4 4.4.4+dfsg-2+deb11u3
has caused the Debian Bug report #1054516,
regarding request-tracker4: CVE-2023-41259 CVE-2023-41260
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1054516: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054516
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: request-tracker4
Version: 4.4.6+dfsg-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Control: found -1 4.4.6+dfsg-1.1
Control: found -1 4.4.4+dfsg-2+deb11u2
Control: found -1 4.4.4+dfsg-2
Control: found -1 4.4.3-2+deb10u2
Control: found -1 4.4.3-2
Hi Andrew, Dominic, Niko
The following vulnerabilities were published for request-tracker4.
Filling it in BTS for visiblity there, and for tracking status in the
various suites.
CVE-2023-41259[0]:
| RT is vulnerable to accepting unvalidated RT email headers in
| incoming email and the mail-gateway REST interface. This vulnerability
| is assigned CVE-2023-41259.
CVE-2023-41260[1]:
| RT is vulnerable to information leakage via response messages returned
| from requests sent via the mail-gateway REST interface. This vulnerability
| is assigned CVE-2023-41260.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2023-41259
https://www.cve.org/CVERecord?id=CVE-2023-41259
[1] https://security-tracker.debian.org/tracker/CVE-2023-41260
https://www.cve.org/CVERecord?id=CVE-2023-41260
[2] https://github.com/bestpractical/rt/releases/tag/rt-4.4.7
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: request-tracker4
Source-Version: 4.4.4+dfsg-2+deb11u3
Done: Andrew Ruthven <[email protected]>
We believe that the bug you reported is fixed in the latest version of
request-tracker4, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Andrew Ruthven <[email protected]> (supplier of updated request-tracker4
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Thu, 26 Oct 2023 00:06:57 +1300
Source: request-tracker4
Architecture: source
Version: 4.4.4+dfsg-2+deb11u3
Distribution: bullseye-security
Urgency: medium
Maintainer: Andrew Ruthven <[email protected]>
Changed-By: Andrew Ruthven <[email protected]>
Closes: 1054516
Changes:
request-tracker4 (4.4.4+dfsg-2+deb11u3) bullseye-security; urgency=medium
.
* Apply upstream patch which fixes several security vulnerabilities
(Closes: 1054516).
- [CVE-2023-41259] Vulnerablility to unvalidated email headers in
incoming email and the mail-gateway REST interface.
- [CVE-2023-41260] Information leakage via response messages returned
from requests sent via the mail-gateway REST interface.
* Add upstream fix to tests for FTBFS due to expired certs.
Checksums-Sha1:
0e2257e75ae282fa6b9e4b00c0af14297c749f04 5572
request-tracker4_4.4.4+dfsg-2+deb11u3.dsc
c953d67fbbec554f50c2f88ee36a980cb90eacdd 151836
request-tracker4_4.4.4+dfsg-2+deb11u3.debian.tar.xz
eae0e6b6f4ac93a97cd4ca040dc9be66c08a50a3 20043
request-tracker4_4.4.4+dfsg-2+deb11u3_amd64.buildinfo
Checksums-Sha256:
0005fb0da6c7a20d98961f90c8c556e3da6473bf430b1a41d96dc5053895df6e 5572
request-tracker4_4.4.4+dfsg-2+deb11u3.dsc
033fe7a8d73a70b0abc97d0402b4c75e486fa042c9c63aac1f7ca1c82e599014 151836
request-tracker4_4.4.4+dfsg-2+deb11u3.debian.tar.xz
4e0aebf585525e6efe523ac5c633a21373f2b2b30799bf0c0ccae1dd9621476a 20043
request-tracker4_4.4.4+dfsg-2+deb11u3_amd64.buildinfo
Files:
bb25782f871c8aee9143bf200503b059 5572 misc optional
request-tracker4_4.4.4+dfsg-2+deb11u3.dsc
5c9725ca3d69d1d73e3fd143df95fd09 151836 misc optional
request-tracker4_4.4.4+dfsg-2+deb11u3.debian.tar.xz
b8c0b2cb6edaf4c230554d0e66a1f4e3 20043 misc optional
request-tracker4_4.4.4+dfsg-2+deb11u3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEExgP8TmAPHOzRyNl8S1PZMeTT6GMFAmU/d4kACgkQS1PZMeTT
6GNigA//W4Is/Ex+bBGs35k7+RcabFTBZqbT7FUdSX3MF/5785MxtLkwA96rv53c
tcF8xQ5zFjqFmtgGpL6q8ZLP7miErq94iy5X7RAf/dIun2GkzSxPIt713LkRpeAH
Jn9NljRCFKjpvSVWVOGYi96aGF9qeCs53AIzI25NydIyl646IDjdF/ggzSN4vXi4
nbU2hT5m2w/XOUeSKqBecCi6H15J6CCkdYoLSHkDtlEJbrESb3VtaLy/Owv9/oGx
hVdlnGVcCqtBZIudiooeVISJh0P5H3UFCbyuaB0NV3hXNnablivwM/X06NjpN9xa
MFsgrMtjJBJ6l3ImgkMJSGFSD8AINwClhKphsZOMwBDPTAuStFcYwf5NAY32xlny
JZ8k/B4ZRfnh11HH9CZlrMjx0twORDfwrzyvY2IJ3pRzTxtp42S3QBNkMaPWImhV
uZcl9CnjYDdmQgGCt7y7JU+F48JMsLT2dZKusBlYQibpGA/SfQ+HtKZ2LwwgbN5V
DN2Z0Y7m88XEp9mmRvEW32BYgBoHo1bKY/oMFMtFHCjh/v1GGobw91HrPQStHdOJ
I2lwPgX2OHQxbFxXAt/aj2ucJXTVeLdwI45aWWm6D/7Wl9p0VgJ5uCp9wzCuyrkD
sW/Qp0Bx8ESweU9iLq5d4QVzaXm9cDxVpauWUFQlrVKar55Cx4A=
=/MkI
-----END PGP SIGNATURE-----
--- End Message ---
