CVE-2017-5361 — Request-tracker4 vulnerability
6 documents5 sources
Severity
5.9MEDIUMNVD
EPSS
0.4%
top 41.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 3
Latest updateMay 13
Description
Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes it easier for remote attackers to obtain sensitive user password information via a timing side-channel attack.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6
Affected Packages2 packages
🔴Vulnerability Details
2📋Vendor Advisories
1Debian▶
CVE-2017-5361: request-tracker4 - Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4....↗2017