CVE-2017-5361

Опубликовано: 03 июл. 2017

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes it easier for remote attackers to obtain sensitive user password information via a timing side-channel attack.

Ссылки

http://www.debian.org/security/2017/dsa-3882
Third Party Advisory
http://www.debian.org/security/2017/dsa-3883
Third Party Advisory
https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016
Vendor Advisory
http://www.debian.org/security/2017/dsa-3882
Third Party Advisory
http://www.debian.org/security/2017/dsa-3883
Third Party Advisory
https://forum.bestpractical.com/t/security-vulnerabilities-in-rt-2017-06-15/32016
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:bestpractical:request_tracker:4.0.0:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.2:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.3:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.4:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.5:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.6:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.7:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.8:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.9:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.10:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.11:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.12:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.13:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.14:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.15:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.16:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.17:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.18:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.19:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.20:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.21:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.22:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.23:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.0.24:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.0:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.1:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.2:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.3:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.4:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.5:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.6:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.7:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.8:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.9:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.10:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.11:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.12:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.2.13:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.4.0:*:*:*:*:*:*:*

cpe:2.3:a:bestpractical:request_tracker:4.4.1:*:*:*:*:*:*:*

EPSS

Процентиль: 58%

0.00358

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2017-5361

CVSS3: 5.9

ubuntu

больше 8 лет назад

CVE-2017-5361

CVSS3: 5.9

debian

больше 8 лет назад

Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x ...

GHSA-qpcq-vgjf-37f6

CVSS3: 5.9

github

больше 3 лет назад

EPSS

Процентиль: 58%

0.00358

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

NVD-CWE-noinfo