Best Practical Request Tracker up to 4.2.16/4.4.4/5.0.1 Auth.pm timing discrepancy

Summaryinfo

A vulnerability was found in Best Practical Request Tracker up to 4.2.16/4.4.4/5.0.1. It has been classified as problematic. Affected by this vulnerability is an unknown functionality in the library lib/RT/REST2/Middleware/Auth.pm. This manipulation causes timing discrepancy. This vulnerability is registered as CVE-2021-38562. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Best Practical Request Tracker up to 4.2.16/4.4.4/5.0.1 (Ticket Tracking Software). It has been declared as problematic. Affected by this vulnerability is an unknown code block in the library lib/RT/REST2/Middleware/Auth.pm. The manipulation with an unknown input leads to a timing discrepancy vulnerability. The CWE definition for the vulnerability is CWE-208. Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. As an impact it is known to affect confidentiality.

The weakness was published 10/18/2021 as 70749bb66cb13dd70bd53340c371038a5f3ca57c. The advisory is shared at github.com. This vulnerability is known as CVE-2021-38562 since 08/11/2021. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 4.2.17, 4.4.5 or 5.0.2 eliminates this vulnerability. The upgrade is hosted for download at docs.bestpractical.com. Applying the patch 70749bb66cb13dd70bd53340c371038a5f3ca57c is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Ticket Tracking Software

Vendor

• Best Practical

Name

• Request Tracker

Version

• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5
• 4.2.6
• 4.2.7
• 4.2.8
• 4.2.9
• 4.2.10
• 4.2.11
• 4.2.12
• 4.2.13
• 4.2.14
• 4.2.15
• 4.2.16
• 4.4.0
• 4.4.1
• 4.4.2
• 4.4.3
• 4.4.4
• 5.0.0
• 5.0.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion