Denial of service
Published Dec 5, 2019
7.5
HIGHCVSS 3.1
EPSS 2.57%
Description
Improper Check for filenames with overly long extensions in PostMaster (sending in email) or uploading files (e.g. attaching files to mails) of ((OTRS)) Community Edition and OTRS allows an remote attacker to cause an endless loop. This issue affects: OTRS AG: ((OTRS)) Community Edition 5.0.x version 5.0.38 and prior versions; 6.0.x version 6.0.23 and prior versions. OTRS AG: OTRS 7.0.x version 7.0.12 and prior versions.
Affected products
Remediation
Vendor solution
Upgrade to OTRS 7.0.13 or OTRS 6.0.24 or OTRS 5.0.39
Patch for ((OTRS)) Community Edition 6.0: https://github.com/OTRS/otrs/commit/799616eb43f7fb53cae4e04c81e2156baaf02e2b Patch for ((OTRS)) Community Edition 5.0: https://github.com/OTRS/otrs/commit/76b301f4e3f45cb23bb6a3d6907028c733d11145
References (6)
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html vendor-advisoryBroken Link
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html vendor-advisoryBroken Link
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html vendor-advisoryBroken Link
- https://community.otrs.com/security-advisory-2019-15-security-update-for-otrs-framework/ PatchVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-7985 Advisory
- https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html mailing-list
| Link | Providers | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html | vendor-advisoryBroken Link | |
| http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html | vendor-advisoryBroken Link | |
| http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html | vendor-advisoryBroken Link | |
| https://community.otrs.com/security-advisory-2019-15-security-update-for-otrs-framework/ | PatchVendor Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-7985 | Advisory | |
| https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html | mailing-list |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
No data
Red Hat
No data
GitHub
No data