CVE-2021-38562

Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm.

References

Affected packages

Git / github.com/bestpractical/rt

Affected ranges

Type

GIT

Repo

https://github.com/bestpractical/rt

Events

Introduced

8130561b24bc13ef2588cbcebfdecbdc305eefbb

Fixed

1fd0c7614d6a204878f01f7c9b3578812df2faae

Introduced

7197d3dade64d6ef63a329fe0e4e24bd05ca9cd9

Fixed

edbeab18ff2a584d3da1bbcd58d4d0c3d180e25b

Introduced

b88a9bf29c440aa6a71fd91c48b4016ec7ab92f3

Fixed

185e82bc4d92ad7d6d5cc7ea4a949d9ad656c85e

Fixed

70749bb66cb13dd70bd53340c371038a5f3ca57c

Database specific

{
    "versions": [
        {
            "introduced": "4.2.0"
        },
        {
            "fixed": "4.2.17"
        },
        {
            "introduced": "4.4.0"
        },
        {
            "fixed": "4.4.5"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.0.2"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-38562.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "35"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    }
]