CVE-2009-5057 — Otrs vulnerability

CWE-3105 documents5 sources
Severity
5.0MEDIUMNVD
EPSS
0.3%
top 48.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Debian Otrs2Otrs
Timeline
PublishedMar 18
Latest updateMay 2

Description

The S/MIME feature in Open Ticket Request System (OTRS) before 2.3.4 does not configure the RANDFILE and HOME environment variables for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available for cryptographic operations, related to inability to write to the seeding file.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶debiandebian/otrs2< otrs2 2.4.5-1 (bullseye)
▶NVDotrs/otrs2.3.3+49

Patches

Patch: bugs.otrs.org ↗Patch: bugs.otrs.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-867g-gm3j-m6qw: The S/MIME feature in Open Ticket Request System (OTRS) before 2↗2022-05-02
▶
OSV
CVE-2009-5057: The S/MIME feature in Open Ticket Request System (OTRS) before 2↗2011-03-18
▶

📋Vendor Advisories

1
Debian
CVE-2009-5057: otrs2 - The S/MIME feature in Open Ticket Request System (OTRS) before 2.3.4 does not co...↗2009
▶

💬Community

1
Bugzilla
CVE-2010-0438 CVE-2010-2080 CVE-2010-3476 CVE-2011-0456 otrs: multiple vulnerabilities [fedora-epel5]↗2010-09-20
▶
CVE-2009-5057 — Otrs vulnerability | cvebase