RT 6.0.4 is now available for general use. This release contains a large number of security updates, and we recommend that all users upgrade as soon as possible. Our documentation site has notes on upgrading from earlier versions and detailed release notes, including information on all of the security fixes.
Security
RT 6.0.4 fixes 30 security issues, the most CVEs we have ever addressed in a single release. Security researchers using AI agents are finding new bugs at a pace we haven’t seen before, and some of them have security impacts. Some of the fixes in this release are for code that has been in use in RT for many years.
This is a challenging time for software maintainers as we work through the new wave of reports, and we expect it to continue for a while. We will continue to review every report we receive and to update RT to keep it safe. Thank you to everyone who has reported vulnerabilities to us. You can find the details for each issue in the release notes.
The same tools are also finding security issues in the open source Perl modules RT depends on, and new versions with fixes are coming out every day. As we have in the past, we are updating the RT cpanfile to require new versions when we know about security updates. But these versions are only as current as the day of the release. Even as we were preparing these releases, we had to update as new versions of modules became available.
Because of this, we recommend that you update all of the Perl modules installed on your RT systems to their latest versions, if possible. We have tested RT with the latest versions of its dependencies and don’t expect any issues running RT with newer modules.
This guidance extends to all of the other dependencies on your RT system. It’s more important than ever to keep up to date on your OS and system-level patches.
Multi-Factor Authentication and Password Management
With account security more important than ever, RT 6.0.4 adds new features to help protect user accounts:
- TOTP multi-factor authentication (MFA), which can be off, optional, or required for different groups of users
- Configurable password policies, such as minimum length and required character classes
- Password reset. RT::Extension::ResetPassword is now part of core RT, with self-service password reset available but disabled by default
These features add a new $SecretKey configuration option, which you should set before users enroll in MFA. See the authentication documentation for details.
Lifecycles, Attachments, and Links
RT 6.0.4 also includes several big updates to the ticket and asset pages and to lifecycle administration:
- Lifecycle editor: The graphical lifecycle editor has been replaced with a new version. You can now add descriptions to statuses and transitions, and the editor shows when you have unsaved changes.
- Lifecycle component: A new lifecycle component for tickets and assets shows the statuses and transitions available to the current user, along with the descriptions from the editor. Users can change the status by clicking on a status in the graph.
- Attachments component: The ticket Attachments component has been rebuilt with search, filtering, and sorting. Users with the ModifyTicket right can add, delete, rename, and pin attachments, and can select several attachments at once to download, delete, or copy to a new ticket.
- Links component: The ticket and asset Links component has been rebuilt with inline editing, search, and filtering. You can now link to assets, articles, transactions, users, groups, and external URLs. Note that merging tickets has moved from the Links component to the Actions menu.
And there are many more updates, improvements, and fixes. See the release notes for the full list.
https://download.bestpractical.com/pub/rt/release/rt-6.0.4.tar.gz
https://download.bestpractical.com/pub/rt/release/rt-6.0.4.tar.gz.asc
SHA-256 sums
0db34899b0462e63c15d0cb23308deac1fe0b84104c65c1e528fedeb52fc33e3 rt-6.0.4.tar.gz
e178d015a3cb9fdb52dccdc82fa258efb9189a5119412f04ad272b6a52fbea47 rt-6.0.4.tar.gz.asc
Watch our blog in the coming weeks for more details on the new features.
Happy upgrading!