CVE-2017-5361

Published: Jul 3, 2017Modified: May 13, 2026

5.9

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 does not use a constant-time comparison algorithm for secrets, which makes it easier for remote attackers to obtain sensitive user password information via a timing side-channel attack.

Affected (41)

Products: Bestpractical: Request Tracker

Bestpractical

1 product

Request Tracker

Configuration A

41 vulnerable

Vulnerable Software	Affected Versions
Bestpractical Request Tracker	Version 4.0.0
Bestpractical Request Tracker	Version 4.0.10
Bestpractical Request Tracker	Version 4.0.11
Bestpractical Request Tracker	Version 4.0.12
Bestpractical Request Tracker	Version 4.0.13
Bestpractical Request Tracker	Version 4.0.14
Bestpractical Request Tracker	Version 4.0.15
Bestpractical Request Tracker	Version 4.0.16
Bestpractical Request Tracker	Version 4.0.17
Bestpractical Request Tracker	Version 4.0.18
Bestpractical Request Tracker	Version 4.0.19
Bestpractical Request Tracker	Version 4.0.1
Bestpractical Request Tracker	Version 4.0.20
Bestpractical Request Tracker	Version 4.0.21
Bestpractical Request Tracker	Version 4.0.22
Bestpractical Request Tracker	Version 4.0.23
Bestpractical Request Tracker	Version 4.0.24
Bestpractical Request Tracker	Version 4.0.2
Bestpractical Request Tracker	Version 4.0.3
Bestpractical Request Tracker	Version 4.0.4
Bestpractical Request Tracker	Version 4.0.5
Bestpractical Request Tracker	Version 4.0.6
Bestpractical Request Tracker	Version 4.0.7
Bestpractical Request Tracker	Version 4.0.8
Bestpractical Request Tracker	Version 4.0.9
Bestpractical Request Tracker	Version 4.2.0
Bestpractical Request Tracker	Version 4.2.10
Bestpractical Request Tracker	Version 4.2.11
Bestpractical Request Tracker	Version 4.2.12
Bestpractical Request Tracker	Version 4.2.13
Bestpractical Request Tracker	Version 4.2.1
Bestpractical Request Tracker	Version 4.2.2
Bestpractical Request Tracker	Version 4.2.3
Bestpractical Request Tracker	Version 4.2.4
Bestpractical Request Tracker	Version 4.2.5
Bestpractical Request Tracker	Version 4.2.6
Bestpractical Request Tracker	Version 4.2.7
Bestpractical Request Tracker	Version 4.2.8
Bestpractical Request Tracker	Version 4.2.9
Bestpractical Request Tracker	Version 4.4.0
Bestpractical Request Tracker	Version 4.4.1