|Description||The vulnerable-passwords script in Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not update the password-hash algorithm for disabled user accounts, which makes it easier for context-dependent attackers to determine cleartext passwords, and possibly use these passwords after accounts are re-enabled, via a brute-force attack on the database. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-0009.|
|Source||CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)|
Vulnerable and fixed packages
The table below lists information on source packages.
|request-tracker4 (PTS)||buster, buster (security)||4.4.3-2+deb10u2||fixed|
|bullseye (security), bullseye||4.4.4+dfsg-2+deb11u2||fixed|
|sid, trixie, bookworm||4.4.6+dfsg-1.1||fixed|
The information below is based on the following data on fixed versions.