-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 01 Jun 2026 13:10:19 +1200 Source: request-tracker5 Binary: request-tracker5 rt5-apache2 rt5-clients rt5-db-mysql rt5-db-postgresql rt5-db-sqlite rt5-doc-html rt5-fcgi rt5-standalone Architecture: all Version: 5.0.3+dfsg-3~deb12u6 Distribution: bookworm-security Urgency: medium Maintainer: all Build Daemon (x86-csail-02) Changed-By: Andrew Ruthven Description: request-tracker5 - extensible trouble-ticket tracking system rt5-apache2 - Apache 2 specific files for request-tracker5 rt5-clients - mail gateway and command-line interface to request-tracker5 rt5-db-mysql - MySQL database backend for request-tracker5 rt5-db-postgresql - PostgreSQL database backend for request-tracker5 rt5-db-sqlite - SQLite database backend for request-tracker5 rt5-doc-html - HTML documentation for request-tracker5 rt5-fcgi - External FastCGI support for request-tracker5 rt5-standalone - Standalone web server support for request-tracker5 Changes: request-tracker5 (5.0.3+dfsg-3~deb12u6) bookworm-security; urgency=medium . * Include missing default configuration items for security vulnerability fixes included in 5.0.3+dfsg-3~deb12u3. Namely: RestrictLinkDomains and Cipher in %SMIME. * Apply upstream patch which fixes several security vulnerabilities: - [CVE-2026-6841] Reflected cross-site scripting via the search "Page" URL parameter. - [CVE-2026-41073] Spreadsheet (CSV/formula) injection via ticket values that are exported to a spreadsheet from search results. User-controlled data is not sanitized before being written to the output file, which can cause spreadsheet applications such as Microsoft Excel to interpret crafted values as formulas or macros when the file is opened. - [CVE-2026-41075] SQL injection via the entry_aggregator parameter in JSON search. An authenticated user can craft input that is incorporated into database queries without proper validation, potentially allowing them to read or modify data in the RT database. - [CVE-2026-41076] LDAP authentication bypass when RT is configured to authenticate users against an LDAP or Active Directory server. Under certain LDAP server configurations, an attacker may be able to authenticate as any LDAP-backed RT user without supplying valid credentials. - [CVE-2026-44229] Cross-site scripting via uploaded content that is served inline rather than as an attachment. - [CVE-2026-44231] Privilege escalation and information disclosure via the REST 2.0 user collection endpoint. A Privileged RT user can obtain authentication credentials belonging to other users, including administrators, and use those credentials to read data via RT's RSS and iCal feed endpoints. The same request that exposes the credentials also rotates them, which invalidates previously-distributed feed URLs across the instance. Checksums-Sha1: 30d7230f7594e786205a0cbe708fc4b650f6ec1f 24254 request-tracker5_5.0.3+dfsg-3~deb12u6_all-buildd.buildinfo 3ff2078130b26d9d572c81b39bad5f8e03dd20a4 12054676 request-tracker5_5.0.3+dfsg-3~deb12u6_all.deb fb26f6cbff26cab6e175af466c742fbbe381bd9a 21912 rt5-apache2_5.0.3+dfsg-3~deb12u6_all.deb 2141c0ec270d883675e8bc31c447ffa4529f7076 54220 rt5-clients_5.0.3+dfsg-3~deb12u6_all.deb b04911ae85de7474f5278a7ef130600e2d30b30b 21244 rt5-db-mysql_5.0.3+dfsg-3~deb12u6_all.deb 1099d9fd6054b692a29de1f99313528ee33717f2 21240 rt5-db-postgresql_5.0.3+dfsg-3~deb12u6_all.deb 8da7281f215f95727998642f44c9f07b30852dc4 21348 rt5-db-sqlite_5.0.3+dfsg-3~deb12u6_all.deb 26fc7194d410ea9c003829ccb850bc45cd08e7e1 4439612 rt5-doc-html_5.0.3+dfsg-3~deb12u6_all.deb e6aa9545f2e56fe0173cc5529bf4bd38d2ee0c95 23972 rt5-fcgi_5.0.3+dfsg-3~deb12u6_all.deb 018b6a6f23041666f8299631e6aa302cb173daab 20712 rt5-standalone_5.0.3+dfsg-3~deb12u6_all.deb Checksums-Sha256: 884c3f82284a57c8d41d9b8916931e97584664945fbe9bc144d349d7dcc75a84 24254 request-tracker5_5.0.3+dfsg-3~deb12u6_all-buildd.buildinfo 91e069c9bc74029310dd7b2b8373e0cc03796e53120c5c78aa22f13bb506bae1 12054676 request-tracker5_5.0.3+dfsg-3~deb12u6_all.deb d62320ffd4d602d65b61dab61409a5fec781e69b3a3ad01e53db191f81f80da1 21912 rt5-apache2_5.0.3+dfsg-3~deb12u6_all.deb 9675a9b8e2eca15132e5b0f2afddd29139f63dc95a48a1b3f38de27ed801f694 54220 rt5-clients_5.0.3+dfsg-3~deb12u6_all.deb 6e7034cb32cf621148f7220a5d40fcd3b5a136d512d309bc13f64f76a8d8a2c5 21244 rt5-db-mysql_5.0.3+dfsg-3~deb12u6_all.deb a2ad79303f2baf4387346dad6b226fea6845531875d337d39811c32b678f057b 21240 rt5-db-postgresql_5.0.3+dfsg-3~deb12u6_all.deb 91e0a4683ef0d98fceee1ec6cff831f82790f76e7636ed501f932c12b0b96b59 21348 rt5-db-sqlite_5.0.3+dfsg-3~deb12u6_all.deb 01f47b28eaf49cbfdda31a2e059f5962f1ea2b5dc5a851ff5f1720b321d701a8 4439612 rt5-doc-html_5.0.3+dfsg-3~deb12u6_all.deb 5574005439f2f0e2230f6c6dcbd1a657ba1718224dcc538bb6ba7778c1db71ce 23972 rt5-fcgi_5.0.3+dfsg-3~deb12u6_all.deb f3a926c15e889c87a4ec1f790974c77a5d8c158ffe10339cc819eb287ac46b13 20712 rt5-standalone_5.0.3+dfsg-3~deb12u6_all.deb Files: 43469b12d2bb1ff4298bec69c559116a 24254 misc optional request-tracker5_5.0.3+dfsg-3~deb12u6_all-buildd.buildinfo b947a4fe6013e6c69794cf1e0d3d0887 12054676 misc optional request-tracker5_5.0.3+dfsg-3~deb12u6_all.deb cf20e04d101b86cd14cfba246131198e 21912 misc optional rt5-apache2_5.0.3+dfsg-3~deb12u6_all.deb e244ac3693066fb74016844c9d997eef 54220 misc optional rt5-clients_5.0.3+dfsg-3~deb12u6_all.deb 91d2eda948af1e4544f41f0b6e4cebbc 21244 misc optional rt5-db-mysql_5.0.3+dfsg-3~deb12u6_all.deb f3da6034f136244286a717c6f3674ae1 21240 misc optional rt5-db-postgresql_5.0.3+dfsg-3~deb12u6_all.deb d1081faae3f3dac20e6426b14f91ce09 21348 misc optional rt5-db-sqlite_5.0.3+dfsg-3~deb12u6_all.deb 045c3cf834ba27e3be0e67e76c96c33b 4439612 doc optional rt5-doc-html_5.0.3+dfsg-3~deb12u6_all.deb 0bed77a260f362dd5face97f12225db6 23972 misc optional rt5-fcgi_5.0.3+dfsg-3~deb12u6_all.deb 1f3b447a23db27ed5954ad05cedc237d 20712 misc optional rt5-standalone_5.0.3+dfsg-3~deb12u6_all.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXLxUpUHQBQBTDtd4aBVi67oXtfkFAmoj/vwACgkQaBVi67oX tfna+g/+NKsGZTOYwfb4Bb9oshjK24K1itXmgKz7RQLHDB7h/2+FfvuTuswdXuxh VWvmgjxcTCM7ypo6GeOpH5029KRYXPMtmw/2o01QU5riUkOqrkR673txywjVXDRq oASd54+DEdLMXmHQrvoXy0dEBpOfZMdomsGhCkUadATbmqOWqcdKtNrciCGwHeGh +sx1DuLkQknRquUXFgBj3aPJ5NrsM5fLT/RBgwC4i1qK9LLIRP2D0Yxlkezc/kqF w4D+CU0mpW2ZVvrHVwpLE09AjdZnuE519htjd4wsxkm1e7yy72zNlqth2p4rxEX1 k1a0nJhtAUn6tIyKPcM/flin7Sg7zHwAedVzl3PpkvXKgj36uPwarhg8sdv/LGpD VKZZRVXxv9xVpHjI1TRAPPAMzqMpexRwd6zroKOYljpGnOXhBk9vcCx7rGSyjF+j b/wyKcFSYZDAD2DQ9ED9rbBblq0G7Z9YnHOW2PXZlCmudycQrI11u3ATRZw/gNEa vGiDmQz/tsmeGppXJn+im3TZIAJiB1LIejsyy+ADwF+oBh71Z5EmgMLLohw0BzgB fE4g57lW9xfuVf+fNXhEXQvdPY7JXOJ3gB8QLLF6stQF0qtib+i97P7AcedYOe4P WuhkGyiNxdUzmykbAUuMGnrfqdbPxZly+b+TwK1AjDVH7EEjmBo= =gKDB -----END PGP SIGNATURE-----