-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 20 Aug 2023 13:02:36 +0200 Source: otrs2 Architecture: source Version: 6.0.16-2+deb10u1 Distribution: buster-security Urgency: high Maintainer: Patrick Matthäi <pmatthaei@debian.org> Changed-By: Guilhem Moulin <guilhem@debian.org> Closes: 945251 959448 980891 989992 991593 Changes: otrs2 (6.0.16-2+deb10u1) buster-security; urgency=high . * Non-maintainer upload by the LTS Security Team. * Fix CVE-2019-11358 (OSA-2020-05): Prototype Pollution vulnerability in embedded jQuery 3.2.1 could allow sending drafted messages as wrong agent. * Fix CVE-2019-12248 (OSA-2019-08): An attacker could send a malicious email to an OTRS system. If a logged in agent user quotes it, the email could cause the browser to load external image resources. * Fix CVE-2019-12497 (OSA-2019-09): In the customer or external frontend, personal information of agents, like Name and mail address in external notes, could be disclosed. * Fix CVE-2019-12746 (OSA-2019-10): A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be then potentially abused in order to impersonate the agent user. * Fix CVE-2019-13458 (OSA-2019-12): An attacker who is logged into OTRS as an agent user with appropriate permissions can leverage OTRS tags in templates in order to disclose hashed user passwords. * Fix CVE-2019-16375 (OSA-2019-13): An attacker who is logged into OTRS as an agent or customer user with appropriate permissions can create a carefully crafted string containing malicious JavaScript code as an article body. This malicious code is executed when an agent compose an answer to the original article. * Fix CVE-2019-18179 (OSA-2019-14): An attacker who is logged into OTRS as an agent is able to list tickets assigned to other agents, which are in the queue where attacker doesn’t have permissions. (Closes: #945251) * Fix CVE-2019-18180 (OSA-2019-15): OTRS can be put into an endless loop by providing filenames with overly long extensions. This applies to the PostMaster (sending in email) and also upload (attaching files to mails, for example). (Closes: #945251) * Fix CVE-2020-1765 (OSA-2020-01): An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, AgentTicketForward, AgentTicketBounce and AgentTicketEmailOutbound. * Fix CVE-2020-1766 (OSA-2020-02): Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. * Fix CVE-2020-1767 (OSA-2020-03): Agent A is able to save a draft (i.e., for customer reply). Then Agent B can open the draft, change the text completely and send it in the name of Agent A. For the customer it will not be visible that the message was sent by another agent. * Fix CVE-2020-1769 (OSA-2020-06): In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. * Fix CVE-2020-1770 (OSA-2020-07): Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. * Fix CVE-2020-1771 (OSA-2020-08): An attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is executed due to the missing parameter encoding. * Fix CVE-2020-1772 (OSA-2020-09): It is possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords. * Fix CVE-2020-1773 (OSA-2020-10): An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting CVE-2020-1772, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. The fix adds ‘libmath-random-secure-perl’ to otrs2' Depends. * Fix CVE-2020-1774 (OSA-2020-11): When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. It is therefore possible to mix them and to send private key to the third-party instead of public key. (Closes: #959448) * Fix CVE-2020-1776 (OSA-2020-13): When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the case the agent is invalid. * Fix CVE-2020-11022 (OSA-2020-14): Potential XSS vulnerability in embedded jQuery 3.2.1's htmlPrefilter and related methods. The fix requires patching embedded copies of fullcalendar (3.4.0), fullcalendar-scheduler (1.6.2) and spectrum (1.8.0). * Fix CVE-2020-11023 (OSA-2020-14): Potential XSS vulnerability in embedded jQuery 3.2.1 when appending HTML containing option elements. * Fix CVE-2021-21252: Regular Expression Denial of Service (ReDoS) vulnerability in in embedded jQuery-validate 1.16.0. (Closes: #980891) * Fix CVE-2021-21439 (OSA-2021-09/ZSA-2021-03): DoS attack can be performed when an email contains specially designed URL in the body. It can lead to the high CPU usage and cause low quality of service, or in extreme case bring the system to a halt. (Closes: #989992) * Fix CVE-2021-21440 (OSA-2021-10/ZSA-2021-08): Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. Also secrets and PIN for the keys are not masked properly. (Closes: #991593) * Fix CVE-2021-21441 (OSA-2021-11/ZSA-2021-06): There is a XSS vulnerability in the ticket overview screens. It is possible to collect various information by having an e-mail shown in the overview screen. An attack can be performed by sending specially crafted e-mail to the system and it does not require any user intraction. (Closes: #989992) * Fix CVE-2021-21443 (OSA-2021-13/ZSA-2021-09): Agents are able to list customer user emails without required permissions in the bulk action screen. (Closes: #991593) * Fix CVE-2021-36091 (OSA-2021-14/ZSA-2021-10): Agents are able to list appointments in the calendars without required permissions. (Closes: #991593) * Fix CVE-2021-36100 (ZSA-2022-02): A specially crafted string in the system configuration allows execution of arbitrary system command. * Fix CVE-2021-41182 (ZSA-2022-01): XSS vulnerability in the `altField` option of the Datepicker widget in embedded jQuery-UI 1.12.1. * Fix CVE-2021-41183 (ZSA-2022-01): XSS vulnerability in `*Text` options of the Datepicker widget in embedded jQuery-UI 1.12.1. * Fix CVE-2021-41184 (ZSA-2022-01): XSS vulnerability in the `of` option of the `.position()` util in embedded jQuery-UI 1.12.1. * Fix CVE-2022-4427 (ZSA-2022-07): SQL injection vulnerability in Kernel::System::Ticket::TicketSearch, which can be exploited using the web service operation "TicketSearch". * Fix CVE-2023-38060: Improper Input Validation vulnerability in the ContentType parameter for attachments on TicketCreate or TicketUpdate operations. * Install empty var/log directory with dh_installdirs not dh_install. * Add DEP-8 tests with upstream's unit tests and (disabled in debci due to flakiness and Policy reasons) Selenium tests. * Update S/MIME unit test certificates with the ones from Znuny 6.0.44. The old ones were failing tests as they had expired. Checksums-Sha1: cd7937f1849914965b7a23104a0bea3a18dc825f 2390 otrs2_6.0.16-2+deb10u1.dsc 90d9749f6b8705712aa02094b49b556c2f6999b9 25013240 otrs2_6.0.16.orig.tar.bz2 ceaf95a01a78a9daa1a81d490a7f860f3f5d65e0 374092 otrs2_6.0.16-2+deb10u1.debian.tar.xz d8127a2a97e16ad973c9c0065ea91c2c19c3fe39 5800 otrs2_6.0.16-2+deb10u1_amd64.buildinfo Checksums-Sha256: 09aaa22dc816c34b6b71f2127daadd52505d001c6c9f0c8367d4b5f58d11f5c8 2390 otrs2_6.0.16-2+deb10u1.dsc 7ec2e235bc0312b1be61b1707ce7d68db8a791e4b9d276e9af8157892969ffcd 25013240 otrs2_6.0.16.orig.tar.bz2 0ca863e96f23b409e7ddc57451a675387d56d82609ce8d74bcda217b6354e83d 374092 otrs2_6.0.16-2+deb10u1.debian.tar.xz fb21a489b8a436871e4183752b14749746d4ff48630d9f06b4f22e738d1aa6d3 5800 otrs2_6.0.16-2+deb10u1_amd64.buildinfo Files: 825da45587977bb0201b076a0061c3c0 2390 non-free/web optional otrs2_6.0.16-2+deb10u1.dsc 5edd2d4c51cb11b87e77d6482dcac2fc 25013240 non-free/web optional otrs2_6.0.16.orig.tar.bz2 ea8ff9098509ad6502766ef5f1d05931 374092 non-free/web optional otrs2_6.0.16-2+deb10u1.debian.tar.xz de476bc179574847b39e9c617cbef4bb 5800 non-free/web optional otrs2_6.0.16-2+deb10u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmTiALQACgkQ05pJnDwh pVIv6A/+KKnBiVV5SZpqzwZfrQbcqrqRLLwJTSTlMyGddQOYVLG/h3nkUoJftdSH a8e0pLHM3EnRXw9idSmnugJ/hp7XpOsNH9/4XnknC9PNql/RmkGEygCccxcEkbpG 4HlJS4+nYYaJ9DdNemqGvjcTR6PYcKhXQm5ULd0GYuW6IufawN0QC9G87QKvZHi+ oPSptGmibOlPl91L5gsh9sBup3Qu5nuhurGN3dQ7BJYMShmELCKRj6itqDKRTI+K hw9Rbv2UEaeTEVQLPQrF/5WVtfKGCkqDDa12NnKrJ1gYdTlrRahNEFbxAud/x/F1 lcOtr8HOXXTc034awlvmjo3UfeBuMKJukr9hvnKBaL5zGocGiDWkN/+v66zVERWA fk5F8Cu7KIgoPL08obLAhiLgo+20ywEMkFi4ZEthE9t02H5vfYpg5ZRoKthShECX q4CyHup+rgWYuDpxNg4h7DuRyqKgDlCBUuJCsDtIqQFfJs3yfsASPr9sRFH+tT52 hkUQiPmAefOKu+aktRa9gz4HiMhYcbOEuywZuoNcG6QYESclyeFZxd4uEYF6+Smv rO85pYdtOqhq7hYOo7N5Qw9z0So7Mmsv4EF1R9Nf0lL90lb1WbL7FFcmmdUouvw6 N9NL6r8GyDkQXhybJ+0j13zmwwbB0+l8N7CPacu15K+8+iwIgBE= =l1Rt -----END PGP SIGNATURE-----
