RT 4.2.14 release candidate 2

We’re pleased to announce the availability of the second release candidate for RT 4.2.14. This release candidate introduces several important security fixes; you can find out more information on our rt-announce mailing list post:


See the 4.2.14rc1 announcement at RT 4.2.14 release candidate 1 for a list of changes to be included in 4.2.14; what follows is only the new changes, all security focused, in rc2 since rc1.


SHA-256 sums

4bc6b1060b69afca289cdb9d61642f1bb3bdb1acb82bf1dea5b1e71e108c6fbd  rt-4.2.14rc2.tar.gz
079bcf013da406c9283ebd600438712a74ec3dc6cb908606905a15451ecc2fbc  rt-4.2.14rc2.tar.gz.asc

Shawn M Moore, for Best Practical

  • RT 4.0.0 and above are vulnerable to an information leak of cross-site request forgery (CSRF) verification tokens if a user visits a specific URL crafted by an attacker. This vulnerability is assigned CVE-2017-5943. It was discovered by a third-party security researcher.

  • RT 4.0.0 and above are vulnerable to a cross-site scripting (XSS) attack if an attacker uploads a malicious file with a certain content type. Installations which use the AlwaysDownloadAttachments config setting are unaffected. This fix addresses all existant and future uploaded attachments. This vulnerability is assigned CVE-2016-6127. This was responsibly disclosed to us first by Scott Russo and the GE Application Security Assessment Team.

  • One of RT’s dependencies, a Perl module named Email::Address, has a denial of service vulnerability which could induce a denial of service of RT itself. We recommend administrators install Email::Address version 1.908 or above, though we additionally provide a new workaround within RT. The Email::Address vulnerability was assigned CVE-2015-7686. This vulnerability’s application to RT was brought to our attention by Pali Rohár.

  • RT 4.0.0 and above are vulnerable to timing side-channel attacks for user passwords. By carefully measuring millions or billions of login attempts, an attacker could crack a user’s password even over the internet. RT now uses a constant-time comparison algorithm for secrets to thwart such attacks. This vulnerability is assigned CVE-2017-5361. This was responsibly disclosed to us by Aaron Kondziela.

  • RT’s ExternalAuth feature is vulnerable to a similar timing side-channel attack. Both RT 4.0/4.2 with the widely-deployed RT::Authen::ExternalAuth extension, as well as the core ExternalAuth feature in RT 4.4 are vulnerable. Installations which don’t use ExternalAuth, or which use ExternalAuth for LDAP/ActiveDirectory authentication, or which use ExternalAuth for cookie-based authentication, are unaffected. Only ExternalAuth in DBI (database) mode is vulnerable.

  • RT 4.0.0 and above are potentially vulnerable to a remote code execution attack in the dashboard subscription interface. A privileged attacker can cause unexpected code to be executed through carefully-crafted saved search names. Though we have not been able to demonstrate an actual attack owing to other defenses in place, it could be possible. This fix addresses all existant and future saved searches. This vulnerability is assigned CVE-2017-5944. It was discovered by an internal security audit.

  • RT 4.0.0 and above have misleading documentation which could reduce system security. The RestrictLoginReferrer config setting (which has security implications) was inconsistent with its implementation, which checked for a slightly different variable name. RT will now check for the incorrect name and produce an error message. This was responsibly disclosed to us by Alex Vandiver.