Publishing details

• Published on 2023-12-04
• Copied from ubuntu mantic in PPA for Ubuntu Security Proposed by Amir Naseredini

Changelog

request-tracker4 (4.4.4+dfsg-2ubuntu1.23.10.1) mantic-security; urgency=medium

  * SECURITY UPDATE: Cross-Site Scripting
    - debian/patches/upstream_4.4.4_cve:_patchset_2022-06-29.diff: fixed an XSS
      in request-tracker (CVE-2022-25802)
    - CVE-2022-25802
  * SECURITY UPDATE: Information Leakage and Unvalidated Headers
    - debian/patches/upstream_4.4-trunk_cve:_avoid_time_side_channel_attack.diff:
      fixed an issue that was resulting in leaking sensitive information
      (CVE-2021-38562)
    - debian/patches/upstream_4.4.3_cve:_patchset_2023-09-26.diff: fixed an
      issue with unvalidated email headers (CVE-2023-41259) and an information
      leakage (CVE-2023-41260) in request-tracker
    - debian/patches/upstream_4.4.3_cve:_patchset_2023-09-26-tests.diff: added
      tests for patches for CVE-2023-41259 and CVE-2023-41260
    - debian/patches/fix_expired_certs.diff: fixes related tests
    - CVE-2021-38562
    - CVE-2023-41259
    - CVE-2023-41260
  * debian/patches/fix_ftbfs.patch: fixex a FTBFS in mantic
  * debian/patches/Update-tests-for-EN-datetime-locale-change-to-space.diff:
    updated broken tests
  * debian/patches/Switch-to-Test-MockTime-HiRes-in-date-api-test.diff: added
    required dependencies
  * debian/patches/update-legacy-timezones.patch: fixed outdated tests
  * debian/control: added the required build dependency

 -- Amir Naseredini <email address hidden>  Thu, 30 Nov 2023 12:26:43 +0000

Builds

• amd64

Built packages

• request-tracker4 extensible trouble-ticket tracking system

• rt4-apache2 Apache 2 specific files for request-tracker4

• rt4-clients mail gateway and command-line interface to request-tracker4

• rt4-db-mysql MySQL database backend for request-tracker4

• rt4-db-postgresql PostgreSQL database backend for request-tracker4

• rt4-db-sqlite SQLite database backend for request-tracker4

• rt4-doc-html HTML documentation for request-tracker4

• rt4-fcgi External FastCGI support for request-tracker4

• rt4-standalone Standalone web server support for request-tracker4

Package files

• request-tracker4_4.4.4+dfsg-2ubuntu1.23.10.1.debian.tar.xz (151.1 KiB)
• request-tracker4_4.4.4+dfsg-2ubuntu1.23.10.1.dsc (5.4 KiB)
• request-tracker4_4.4.4+dfsg-2ubuntu1.23.10.1_all.deb (3.7 MiB)
• request-tracker4_4.4.4+dfsg.orig-third-party-source.tar.gz (3.0 MiB)
• request-tracker4_4.4.4+dfsg.orig.tar.gz (9.5 MiB)
• rt4-apache2_4.4.4+dfsg-2ubuntu1.23.10.1_all.deb (15.5 KiB)
• rt4-clients_4.4.4+dfsg-2ubuntu1.23.10.1_all.deb (47.2 KiB)
• rt4-db-mysql_4.4.4+dfsg-2ubuntu1.23.10.1_all.deb (14.8 KiB)
• rt4-db-postgresql_4.4.4+dfsg-2ubuntu1.23.10.1_all.deb (14.8 KiB)
• rt4-db-sqlite_4.4.4+dfsg-2ubuntu1.23.10.1_all.deb (14.9 KiB)
• rt4-doc-html_4.4.4+dfsg-2ubuntu1.23.10.1_all.deb (1.5 MiB)
• rt4-fcgi_4.4.4+dfsg-2ubuntu1.23.10.1_all.deb (17.3 KiB)
• rt4-standalone_4.4.4+dfsg-2ubuntu1.23.10.1_all.deb (14.2 KiB)