CVE-2017-5361
CVE-2017-5361
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes it easier for remote attackers to obtain sensitive user password information via a timing side-channel attack.
CVSS 5.9 · Medium · EPSS 1.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
request-tracker4 Debian:12
- Affected ranges
- ECOSYSTEM: < 4.4.1-4
Update to 4.4.1-4
rt-authen-externalauth Ubuntu:16.04:LTS
- Versions
- 0.25-1
- Affected ranges
- ECOSYSTEM: < 0.25-1+deb8u1build0.16.04.1
Update to 0.25-1+deb8u1build0.16.04.1
request-tracker4 Ubuntu:16.04:LTS
- Versions
- 4.2.11-2
- 4.2.12-3
- 4.2.12-4
- 4.2.12-5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published