| Package | Affected versions | Patched versions |
|---|---|---|
| request tracker | = 3.8.10= 3.8.11= 3.8.12= 3.8.13= 3.8.14= 3.8.3= 3.8.4= 3.8.7= 3.8.9= 4.0.0= 4.0.1= 4.0.2= 4.0.3= 4.0.4= 4.0.5= 4.0.6= 4.0.7 |
Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled with a "Sign by default" queue configuration, uses a queue's key for signing, which might allow remote attackers to spoof messages by leveraging the lack of authentication semantics.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free