Debian/request-tracker4: low 2.6
Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used.
Action: Upgrade request-tracker4 to 4.4.6+dfsg-1.1+deb12u3 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.4.6+dfsg-1.1+deb12u3 | - |
Fixed versions
| 4.4.6+dfsg-1.1+deb12u3 |
Sources
published · modified · JSON