Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, allows remote attackers to configure encryption or signing for certain outbound e-mail, and possibly cause a denial of service (loss of e-mail readability), via an e-mail message to a queue's address.
| Software | From | Fixed in |
|---|---|---|
| bestpractical / request_tracker | 3.8.7 | 3.8.7.x |
| bestpractical / request_tracker | 3.8.14 | 3.8.14.x |
| bestpractical / request_tracker | 3.8.9 | 3.8.9.x |
| bestpractical / request_tracker | 3.8.10 | 3.8.10.x |
| bestpractical / request_tracker | 3.8.13 | 3.8.13.x |
| bestpractical / request_tracker | 3.8.11 | 3.8.11.x |
| bestpractical / request_tracker | 3.8.12 | 3.8.12.x |
| bestpractical / request_tracker | 3.8.4 | 3.8.4.x |
| bestpractical / request_tracker | 3.8.3 | 3.8.3.x |
| bestpractical / request_tracker | 4.0.0 | 4.0.0.x |
| bestpractical / request_tracker | 4.0.6 | 4.0.6.x |
| bestpractical / request_tracker | 4.0.7 | 4.0.7.x |
| bestpractical / request_tracker | 4.0.5 | 4.0.5.x |
| bestpractical / request_tracker | 4.0.1 | 4.0.1.x |
| bestpractical / request_tracker | 4.0.2 | 4.0.2.x |
| bestpractical / request_tracker | 4.0.4 | 4.0.4.x |
| bestpractical / request_tracker | 4.0.3 | 4.0.3.x |