RT 5.0.11 is now available for general use. This release contains a large number of security updates, and we recommend that all users upgrade as soon as possible. Our documentation site has notes on upgrading from earlier versions and detailed release notes, including information on all of the security fixes.
Security
RT 5.0.11 fixes 28 security issues, the most CVEs we have ever addressed in a single release. Security researchers using AI agents are finding new bugs at a pace we haven’t seen before, and some of them have security impacts. Some of the fixes in this release are for code that has been in use in RT for many years.
This is a challenging time for software maintainers as we work through the new wave of reports, and we expect it to continue for a while. We will continue to review every report we receive and to update RT to keep it safe. Thank you to everyone who has reported vulnerabilities to us. You can find the details for each issue in the release notes.
The same tools are also finding security issues in the open source Perl modules RT depends on, and new versions with fixes are coming out every day. As we have in the past, we are updating the RT cpanfile to require new versions when we know about security updates. But these versions are only as current as the day of the release. Even as we were preparing these releases, we had to update as new versions of modules became available.
Because of this, we recommend that you update all of the Perl modules installed on your RT systems to their latest versions, if possible. We have tested RT with the latest versions of its dependencies and don’t expect any issues running RT with newer modules.
This guidance extends to all of the other dependencies on your RT system. It’s more important than ever to keep up to date on your OS and system-level patches.
Multi-Factor Authentication and Password Management
RT 5 is in maintenance mode, but with account security more important than ever, RT 5.0.11 adds new features to help protect user accounts:
- TOTP multi-factor authentication (MFA), which can be off, optional, or required for different groups of users
- Configurable password policies, such as minimum length and required character classes
- Password reset. RT::Extension::ResetPassword is now part of core RT, with self-service password reset available but disabled by default
These features add a new $SecretKey configuration option, which you should set before users enroll in MFA. See the authentication documentation for details.
https://download.bestpractical.com/pub/rt/release/rt-5.0.11.tar.gz
https://download.bestpractical.com/pub/rt/release/rt-5.0.11.tar.gz.asc
SHA-256 sums
f8e9e631938acb37f9cb0189ae63c22009ddd1519041eae79cc55ac337273476 rt-5.0.11.tar.gz
d4d0003d012c2733bc54aaa2108ba30477e2022290e026603fc7803670fbae1e rt-5.0.11.tar.gz.asc
For lots of new features beyond these, try RT 6!