request-tracker5 - Debian Package Tracker

general

source: request-tracker5 (main)
version: 5.0.10+dfsg-3
maintainer: Debian Request Tracker Group (archive) (DMD)
uploaders: Dominic Hargreaves (DMD) – Niko Tyni (DMD) – Andrew Ruthven (DMD)
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 5.0.3+dfsg-3~deb12u6
old-sec: 5.0.3+dfsg-3~deb12u6
old-p-u: 5.0.3+dfsg-3~deb12u6
stable: 5.0.7+dfsg-4+deb13u3
stable-sec: 5.0.7+dfsg-4+deb13u3
testing: 5.0.10+dfsg-3
unstable: 5.0.10+dfsg-3

versioned links

5.0.3+dfsg-3~deb12u6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.0.7+dfsg-4+deb13u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.0.10+dfsg-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

request-tracker5 (12 bugs: 0, 8, 4, 0)
rt5-apache2
rt5-clients (4 bugs: 0, 0, 4, 0)
rt5-db-mysql
rt5-db-postgresql
rt5-db-sqlite
rt5-doc-html (1 bugs: 0, 0, 1, 0)
rt5-fcgi
rt5-standalone

action needed

Marked for autoremoval on 13 December: #1152514, #1152579 high

Version 5.0.10+dfsg-3 of request-tracker5 is marked for autoremoval from testing on Sun 13 Dec 2026. It is affected by #1152514, #1152579. The removal of request-tracker5 will also cause the removal of (transitive) reverse dependencies: libmodule-install-rtx-perl, rt-extension-assetautoname, rt-extension-assets-import-csv, rt-extension-calendar, rt-extension-commandbymail, rt-extension-customfieldsonupdate, rt-extension-elapsedbusinesstime, rt-extension-jsgantt, rt-extension-mergeusers, rt-extension-nagios, rt-extension-repeatticket, rt-extension-resetpassword, rt-extension-smsnotify. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-11-06 Last update: 2026-11-07 22:19

A new upstream version is available: 5.0.11 high

A new upstream version 5.0.11 is available, you should consider packaging it.

Created: 2026-10-31 Last update: 2026-11-07 17:49

28 security issues in trixie high

There are 28 open security issues in trixie.

28 important issues:

CVE-2026-105454: RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to break out of the link's address can add a script that runs when the ticket history is displayed, with no further action by the viewer. Anyone who can add HTML content to a ticket can plant it. That includes an unauthenticated sender of HTML email to any queue that grants CreateTicket or ReplyToTicket to Everyone, which is routine for a queue that accepts mail from the public. The script runs in the session of any user who views the ticket, and can act in RT with that user's authority. This issue was fixed in version 5.0.11 and 6.0.4
CVE-2026-108270:
CVE-2026-108271:
CVE-2026-108272:
CVE-2026-108273:
CVE-2026-108274:
CVE-2026-108275:
CVE-2026-108276:
CVE-2026-108277:
CVE-2026-108278:
CVE-2026-108279:
CVE-2026-108280:
CVE-2026-108281:
CVE-2026-108282:
CVE-2026-108342:
CVE-2026-108343:
CVE-2026-108344:
CVE-2026-108346:
CVE-2026-108347:
CVE-2026-108348:
CVE-2026-108349:
CVE-2026-108350:
CVE-2026-108351:
CVE-2026-108352:
CVE-2026-108353:
CVE-2026-108363:
CVE-2026-108365:
CVE-2026-108371:

Created: 2026-10-30 Last update: 2026-10-31 08:02

28 security issues in sid high

There are 28 open security issues in sid.

28 important issues:

CVE-2026-105454: RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to break out of the link's address can add a script that runs when the ticket history is displayed, with no further action by the viewer. Anyone who can add HTML content to a ticket can plant it. That includes an unauthenticated sender of HTML email to any queue that grants CreateTicket or ReplyToTicket to Everyone, which is routine for a queue that accepts mail from the public. The script runs in the session of any user who views the ticket, and can act in RT with that user's authority. This issue was fixed in version 5.0.11 and 6.0.4
CVE-2026-108270:
CVE-2026-108271:
CVE-2026-108272:
CVE-2026-108273:
CVE-2026-108274:
CVE-2026-108275:
CVE-2026-108276:
CVE-2026-108277:
CVE-2026-108278:
CVE-2026-108279:
CVE-2026-108280:
CVE-2026-108281:
CVE-2026-108282:
CVE-2026-108342:
CVE-2026-108343:
CVE-2026-108344:
CVE-2026-108346:
CVE-2026-108347:
CVE-2026-108348:
CVE-2026-108349:
CVE-2026-108350:
CVE-2026-108351:
CVE-2026-108352:
CVE-2026-108353:
CVE-2026-108363:
CVE-2026-108365:
CVE-2026-108371:

Created: 2026-10-30 Last update: 2026-10-31 08:02

28 security issues in forky high

There are 28 open security issues in forky.

28 important issues:

CVE-2026-105454: RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to break out of the link's address can add a script that runs when the ticket history is displayed, with no further action by the viewer. Anyone who can add HTML content to a ticket can plant it. That includes an unauthenticated sender of HTML email to any queue that grants CreateTicket or ReplyToTicket to Everyone, which is routine for a queue that accepts mail from the public. The script runs in the session of any user who views the ticket, and can act in RT with that user's authority. This issue was fixed in version 5.0.11 and 6.0.4
CVE-2026-108270:
CVE-2026-108271:
CVE-2026-108272:
CVE-2026-108273:
CVE-2026-108274:
CVE-2026-108275:
CVE-2026-108276:
CVE-2026-108277:
CVE-2026-108278:
CVE-2026-108279:
CVE-2026-108280:
CVE-2026-108281:
CVE-2026-108282:
CVE-2026-108342:
CVE-2026-108343:
CVE-2026-108344:
CVE-2026-108346:
CVE-2026-108347:
CVE-2026-108348:
CVE-2026-108349:
CVE-2026-108350:
CVE-2026-108351:
CVE-2026-108352:
CVE-2026-108353:
CVE-2026-108363:
CVE-2026-108365:
CVE-2026-108371:

Created: 2026-10-30 Last update: 2026-10-31 08:02

28 security issues in bookworm high

There are 28 open security issues in bookworm.

28 important issues:

CVE-2026-105454: RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to break out of the link's address can add a script that runs when the ticket history is displayed, with no further action by the viewer. Anyone who can add HTML content to a ticket can plant it. That includes an unauthenticated sender of HTML email to any queue that grants CreateTicket or ReplyToTicket to Everyone, which is routine for a queue that accepts mail from the public. The script runs in the session of any user who views the ticket, and can act in RT with that user's authority. This issue was fixed in version 5.0.11 and 6.0.4
CVE-2026-108270:
CVE-2026-108271:
CVE-2026-108272:
CVE-2026-108273:
CVE-2026-108274:
CVE-2026-108275:
CVE-2026-108276:
CVE-2026-108277:
CVE-2026-108278:
CVE-2026-108279:
CVE-2026-108280:
CVE-2026-108281:
CVE-2026-108282:
CVE-2026-108342:
CVE-2026-108343:
CVE-2026-108344:
CVE-2026-108346:
CVE-2026-108347:
CVE-2026-108348:
CVE-2026-108349:
CVE-2026-108350:
CVE-2026-108351:
CVE-2026-108352:
CVE-2026-108353:
CVE-2026-108363:
CVE-2026-108365:
CVE-2026-108371:

Created: 2026-10-30 Last update: 2026-10-31 08:02

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 5.0.10+dfsg-4, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 808ec8899b204a4bed44ebb8e26c81769c166f1f
Author: Andrew Ruthven <andrew@etc.gen.nz>
Date:   Sat Aug 29 21:58:30 2026 +1200

    Update bug subject

Created: 2026-10-18 Last update: 2026-11-07 22:20

2 bugs with a patch to review in the bug tracker normal

The bug tracker contains patches fixing 2 bugs to review: include them, or remove the patch tag.

Created: 2026-09-02 Last update: 2026-11-07 22:18

lintian reports 38 warnings normal

Lintian reports 38 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-10-16 Last update: 2026-10-27 19:31

debian/patches: 3 patches to forward upstream low

Among the 29 debian patches available in version 5.0.10+dfsg-3 of the package, we noticed the following issues:

3 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-06-21 07:30

news

[rss feed]

[2026-06-26] request-tracker5 5.0.10+dfsg-3 MIGRATED to testing (Debian testing watch)
[2026-06-21] Accepted request-tracker5 5.0.10+dfsg-3 (source) into unstable (Andrew Ruthven)
[2026-06-20] Accepted request-tracker5 5.0.10+dfsg-2 (source) into unstable (Andrew Ruthven)
[2026-06-08] Accepted request-tracker5 5.0.7+dfsg-4+deb13u3 (source) into proposed-updates (Debian FTP Masters) (signed by: Andrew Ruthven)
[2026-06-08] Accepted request-tracker5 5.0.3+dfsg-3~deb12u6 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Andrew Ruthven)
[2026-06-06] Accepted request-tracker5 5.0.3+dfsg-3~deb12u6 (source) into oldstable-security (Debian FTP Masters) (signed by: Andrew Ruthven)
[2026-06-06] Accepted request-tracker5 5.0.7+dfsg-4+deb13u3 (source) into stable-security (Debian FTP Masters) (signed by: Andrew Ruthven)
[2026-05-27] request-tracker5 5.0.10+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-05-21] Accepted request-tracker5 5.0.10+dfsg-1 (source) into unstable (Andrew Ruthven)
[2026-03-28] Accepted request-tracker5 5.0.3+dfsg-3~deb12u5 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Andrew Ruthven)
[2026-03-28] Accepted request-tracker5 5.0.7+dfsg-4+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Andrew Ruthven)
[2026-03-25] request-tracker5 5.0.9+dfsg-4 MIGRATED to testing (Debian testing watch)
[2026-03-20] Accepted request-tracker5 5.0.9+dfsg-4 (source) into unstable (Andrew Ruthven)
[2026-03-08] request-tracker5 5.0.9+dfsg-3 MIGRATED to testing (Debian testing watch)
[2026-03-03] Accepted request-tracker5 5.0.9+dfsg-3 (source) into unstable (Andrew Ruthven)
[2026-03-02] Accepted request-tracker5 5.0.9+dfsg-2 (source) into unstable (Andrew Ruthven)
[2026-02-14] Accepted request-tracker5 5.0.9+dfsg-1 (source) into unstable (Andrew Ruthven)
[2025-11-01] Accepted request-tracker5 5.0.3+dfsg-3~deb12u4 (source all) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Andrew Ruthven)
[2025-10-30] request-tracker5 5.0.7+dfsg-6 MIGRATED to testing (Debian testing watch)
[2025-10-29] Accepted request-tracker5 5.0.7+dfsg-4+deb13u1 (source all) into proposed-updates (Debian FTP Masters) (signed by: Andrew Ruthven)
[2025-10-27] Accepted request-tracker5 5.0.7+dfsg-6 (source) into unstable (Andrew Ruthven)
[2025-10-23] Accepted request-tracker5 5.0.7+dfsg-5 (source all) into unstable (Andrew Ruthven)
[2025-10-22] Accepted request-tracker5 5.0.3+dfsg-3~deb12u4 (source all) into oldstable-security (Debian FTP Masters) (signed by: Andrew Ruthven)
[2025-10-22] Accepted request-tracker5 5.0.7+dfsg-4+deb13u1 (source all) into stable-security (Debian FTP Masters) (signed by: Andrew Ruthven)
[2025-05-26] request-tracker5 5.0.7+dfsg-4 MIGRATED to testing (Debian testing watch)
[2025-05-21] Accepted request-tracker5 5.0.7+dfsg-4 (source) into unstable (Andrew Ruthven)
[2025-05-14] request-tracker5 5.0.7+dfsg-3 MIGRATED to testing (Debian testing watch)
[2025-05-04] Accepted request-tracker5 5.0.7+dfsg-3 (source) into unstable (Andrew Ruthven)
[2025-05-03] Accepted request-tracker5 5.0.3+dfsg-3~deb12u3 (source) into proposed-updates (Debian FTP Masters) (signed by: Andrew Ruthven)
[2025-04-30] Accepted request-tracker5 5.0.3+dfsg-3~deb12u3 (source) into stable-security (Debian FTP Masters) (signed by: Andrew Ruthven)

bugs [bug history graph]

all: 22
RC: 2
I&N: 9
M&W: 10
F&P: 1
patch: 2

links

homepage
lintian (0, 38)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
l10n (98, 55)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 5.0.10+dfsg-3
3 bugs (1 patch)