Debian: DSA-4047-1: otrs2 security update

Date 23 Nov 2017

Category Debian Linux Distribution - Security Advisories

443

Posted By LinuxSecurity Advisories

Two vulnerabilities were discovered in the Open Ticket Request System which could result in disclosure of database credentials or the execution of arbitrary shell commands by logged-in agents.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4047-1                   This email address is being protected from spambots. You need JavaScript enabled to view it.
https://www.debian.org/security/                       Moritz Muehlenhoff
November 23, 2017                     https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : otrs2
CVE ID         : CVE-2017-15864 CVE-2017-16664

Two vulnerabilities were discovered in the Open Ticket Request System
which could result in disclosure of database credentials or the
execution of arbitrary shell commands by logged-in agents.

For the oldstable distribution (jessie), these problems have been fixed
in version 3.3.18-1+deb8u2.

For the stable distribution (stretch), these problems have been fixed in
version 5.0.16-1+deb9u3.

We recommend that you upgrade your otrs2 packages.

For the detailed security status of otrs2 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/otrs2

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.