CVE-2021-38562

NameCVE-2021-38562
DescriptionBest Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3057-1
Debian Bugs995167, 995175

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
request-tracker4 (PTS)bullseye (security), bullseye4.4.4+dfsg-2+deb11u3fixed
bookworm, bookworm (security)4.4.6+dfsg-1.1+deb12u1fixed
sid, trixie4.4.7+dfsg-3fixed
request-tracker5 (PTS)bookworm, bookworm (security)5.0.3+dfsg-3~deb12u2fixed
sid5.0.7+dfsg-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
request-tracker4sourcestretch4.4.1-3+deb9u4DLA-3057-1
request-tracker4sourcebuster4.4.3-2+deb10u1
request-tracker4sourcebullseye4.4.4+dfsg-2+deb11u1
request-tracker4source(unstable)4.4.4+dfsg-3995175
request-tracker5source(unstable)5.0.3+dfsg-1995167

Notes

https://github.com/bestpractical/rt/commit/70749bb66cb13dd70bd53340c371038a5f3ca57c (rt-5.0.2)
https://github.com/bestpractical/rt/commit/d16f8cf13c2af517ee55a85e7b91a0267477189f (rt-4.4.5)
https://github.com/bestpractical/rt/commit/d16f8cf13c2af517ee55a85e7b91a0267477189f (rt-4.2.17)

Search for package or bug name: Reporting problems