Your message dated Thu, 21 May 2026 12:18:48 +0000
with message-id <[email protected]>
and subject line Bug#1109102: fixed in request-tracker5 5.0.10+dfsg-1
has caused the Debian Bug report #1109102,
regarding request-tracker5: systemd unit dependencies missing the .service
suffix
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1109102: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109102
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: request-tracker5
Version: 5.0.3+dfsg-3~deb12u3
Severity: normal
Dear Maintainer,
We're running rt5 on debian 12, installed directly from
the debian packages (request-tracker5, rt5-apache2, rt5-db-mysql).
We've noticed that the systemd service unit for request5 is missing
the .service suffix for the dependencies:
/etc/systemd/system/multi-user.target.wants/request-tracker5.service
[[
Description=Dummy service to enforce web/database server startup ordering
After=mysql postgresql
Before=apache2
]]
journalct --unit request-tracker5 shows the errors:
[[
/lib/systemd/system/request-tracker5.service:8: Failed to add dependency on
mysql, ignoring: Invalid argument
/lib/systemd/system/request-tracker5.service:8: Failed to add dependency on
postgresql, ignoring: Invalid argument
/lib/systemd/system/request-tracker5.service:9: Failed to add dependency on
apache2, ignoring: Invalid argument
]]
To fix this, you should add the .service suffix as follows:
[[
After=mysql.service postgresql.service
Before=apache2.service
]]
As the dependencies were not taken into account, I wonder if they
are still useful at all or if it's a recent error..
By the way, I'm confused why the dependencies for both mysql were
added by default. Shouldn't they be added depending on whether you
install the rt5-db-mysql or rt5-db-postgress packages?
Probably not important. After applying the .service fix, I noticed
that journalctl seems to ignore the dependency to postgresql if
it's not installed.
Hope this report helps.
KUDOS,
-jk
*** Reporter, please consider answering these questions, where appropriate ***
* What led up to the situation?
* What exactly did you do (or not do) that was effective (or
ineffective)?
* What was the outcome of this action?
* What outcome did you expect instead?
*** End of the template - remove these template lines ***
-- Package-specific info:
Changed files:
/var/cache/request-tracker5/mason_data
/var/cache/request-tracker5/mason_data/cache
/var/cache/request-tracker5/mason_data/etc
/var/cache/request-tracker5/mason_data/obj
/var/cache/request-tracker5/session_data
/var/lib/request-tracker5/data
/var/lib/request-tracker5/data/gpg
-- System Information:
Debian Release: 12.11
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.1.0-37-amd64 (SMP w/4 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages request-tracker5 depends on:
ii dbconfig-common 2.0.24
ii debconf [debconf-2.0] 1.5.82
ii fonts-droid-fallback 1:6.0.1r16-1.1
ii fonts-noto-hinted 20201225-1
ii libapache-session-perl 1.94-2
ii libbusiness-hours-perl 0.13-2
ii libcgi-emulate-psgi-perl 0.23-2
ii libcgi-pm-perl 4.55-1
ii libcgi-psgi-perl 0.15-3
ii libclass-accessor-perl 0.51-2
ii libclone-perl 0.46-1
ii libconvert-color-perl 0.16-1
ii libcpanel-json-xs-perl 4.35-1
ii libcrypt-eksblowfish-perl 0.009-3+b1
ii libcrypt-x509-perl 0.55-1
ii libcss-minifier-xs-perl 0.13-1+b2
ii libcss-squish-perl 0.10-1
ii libdata-guid-perl 0.051-1
ii libdata-ical-perl 0.24+dfsg-2
ii libdata-page-pageset-perl 1.02-2
ii libdate-extract-perl 0.07-1
ii libdate-manip-perl 6.91-1
ii libdatetime-format-natural-perl 1.16-1
ii libdatetime-locale-perl 1:1.37-1
ii libdatetime-perl 2:1.59-1
ii libdbi-perl 1.643-4
ii libdbix-searchbuilder-perl 1.76-1
ii libdevel-globaldestruction-perl 0.14-4
ii libemail-address-list-perl 0.06-2
ii libemail-address-perl 1.913-1
ii libencode-detect-perl 1.01-6+b1
ii libencode-hanextra-perl 0.23-6+b1
ii libfile-sharedir-perl 1.118-3
ii libfile-which-perl 1.27-2
ii libgd-graph-perl 1.54~ds-4
ii libgd-text-perl 0.86-10
ii libgnupg-interface-perl 1.02-3
ii libgraphviz-perl 2.24-1
ii libhtml-formatexternal-perl 26-6
ii libhtml-formattext-withlinks-andtables-perl 0.07-2
ii libhtml-formattext-withlinks-perl 0.15-3
ii libhtml-gumbo-perl 0.18-3+b1
ii libhtml-mason-perl 1:1.59-2
ii libhtml-mason-psgihandler-perl 0.53-2
ii libhtml-quoted-perl 0.04-3
ii libhtml-rewriteattributes-perl 0.05-3
ii libhtml-scrubber-perl 0.19-2
ii libhttp-message-perl 6.44-1
ii libipc-run-perl 20220807.0-1
ii libipc-run3-perl 0.048-3
ii libjavascript-minifier-xs-perl 0.15-1+b2
ii libjson-perl 4.10000-1
ii liblist-moreutils-perl 0.430-2
ii liblocale-maketext-fuzzy-perl 0.11-3
ii liblocale-maketext-lexicon-perl 1.00-3
ii liblog-dispatch-perl 2.70-1
ii libmailtools-perl 2.21-2
ii libmime-tools-perl 5.510-1
ii libmime-types-perl 2.24-1
ii libmodule-path-perl 0.19-3
ii libmodule-refresh-perl 0.18-2
ii libmodule-versions-report-perl 1.06-4
ii libmoose-perl 2.2203-1
ii libmoosex-nonmoose-perl 0.26-2
ii libmoosex-role-parameterized-perl 1.11-2
ii libnet-cidr-perl 0.21-2
ii libnet-ip-perl 1.26-3
ii libnet-ldap-perl 1:0.6800+dfsg-1
ii libnet-ssleay-perl 1.92-2+b1
ii libparallel-forkmanager-perl 2.02-1
ii libpath-dispatcher-perl 1.08-2
ii libperlio-eol-perl 0.17-2+b1
ii libplack-perl 1.0050-1
ii libpod-parser-perl 1.65-1
ii libregexp-common-net-cidr-perl 0.03-2
ii libregexp-common-perl 2017060201-3
ii libregexp-ipv6-perl 0.03-3
ii librole-basic-perl 0.13-4
ii libscope-upper-perl 0.34-1
ii libstring-shellquote-perl 1.04-3
ii libsymbol-global-name-perl 0.05-4
ii libtext-autoformat-perl 1.750000-2
ii libtext-password-pronounceable-perl 0.30-3
ii libtext-quoted-perl 2.10-2
ii libtext-template-perl 1.61-1
ii libtext-wikiformat-perl 0.79-1.2
ii libtext-worddiff-perl 0.09-2
ii libtext-wrapper-perl 1.05-4
ii libtime-parsedate-perl 2015.103-4
ii libtimedate-perl 2.3300-2
ii libtree-simple-perl 1.34-2
ii libuniversal-require-perl 0.19-3
ii liburi-perl 5.17-1
ii libweb-machine-perl 0.17-3
ii libwww-perl 6.68-1
ii libxml-rss-perl 1.62-1
ii libxml-simple-perl 2.25-2
ii perl [libencode-perl] 5.36.0-7+deb12u2
ii perl-doc 5.36.0-7+deb12u2
ii postfix [mail-transport-agent] 3.7.11-0+deb12u1
ii rt5-clients 5.0.3+dfsg-3~deb12u3
ii rt5-db-mysql 5.0.3+dfsg-3~deb12u3
ii rt5-standalone 5.0.3+dfsg-3~deb12u3
ii ucf 3.0043+nmu1+deb12u1
Versions of packages request-tracker5 recommends:
ii cron [cron-daemon] 3.0pl1-162
ii libfile-dropbox-perl 0.7-2
ii libnet-amazon-s3-perl 0.991-1
ii rsyslog [system-log-daemon] 8.2302.0-1+deb12u1
ii w3m 0.5.3+git20230121-2
Versions of packages request-tracker5 suggests:
pn rt5-doc-html <none>
-- debconf information:
request-tracker5/purge: false
request-tracker5/dbconfig-upgrade: true
request-tracker5/install-error: abort
request-tracker5/mysql/authplugin: default
request-tracker5/db/app-user: rtuser@localhost
request-tracker5/remote/host: localhost
request-tracker5/webbaseurl: http://kiribati.inrialpes.fr
request-tracker5/internal/skip-preseed: false
request-tracker5/db/dbname: rtdb
* request-tracker5/dbconfig-install: true
* request-tracker5/database-type: mysql
request-tracker5/mysql/method: Unix socket
request-tracker5/dbconfig-remove: true
* request-tracker5/rtname: rt.kiribati.inrialpes.fr
request-tracker5/passwords-do-not-match:
request-tracker5/missing-db-package-error: abort
request-tracker5/upgrade-error: abort
* request-tracker5/mysql/admin-user: root
request-tracker5/dbconfig-reinstall: false
request-tracker5/internal/reconfiguring: false
request-tracker5/organization: kiribati.inrialpes.fr
* request-tracker5/handle-siteconfig-permissions: true
request-tracker5/remote/newhost:
request-tracker5/remote/port:
request-tracker5/install-cronjobs:
request-tracker5/correspondaddress: [email protected]
request-tracker5/upgrade-backup: true
request-tracker5/remove-error: abort
request-tracker5/commentaddress: [email protected]
request-tracker5/webpath: /rt
--- End Message ---
--- Begin Message ---
Source: request-tracker5
Source-Version: 5.0.10+dfsg-1
Done: Andrew Ruthven <[email protected]>
We believe that the bug you reported is fixed in the latest version of
request-tracker5, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Andrew Ruthven <[email protected]> (supplier of updated request-tracker5
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 21 May 2026 20:44:52 +1200
Source: request-tracker5
Architecture: source
Version: 5.0.10+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Andrew Ruthven <[email protected]>
Changed-By: Andrew Ruthven <[email protected]>
Closes: 1109102
Changes:
request-tracker5 (5.0.10+dfsg-1) unstable; urgency=medium
.
* New upstream release.
- [CVE-2026-41075] Fix SQL injection via the entry_aggregator parameter in
JSON search. An authenticated user can craft input that is incorporated
into database queries without proper validation, potentially allowing
them to read or modify data in the RT database.
- [CVE-2026-41076] Fix an LDAP authentication bypass when RT is configured
to authenticate users against an LDAP or Active Directory server. Under
certain LDAP server configurations, an attacker may be able to
authenticate as any LDAP-backed RT user without supplying valid
credentials.
- [CVE-2026-6841] Fix a reflected cross-site scripting via the search
"Page"
URL parameter.
- [CVE-2026-44227] Fix a reflected cross-site scripting via additional URL
parameters on search pages.
- [CVE-2026-44230] Fix a reflected cross-site scripting on search-results
chart pages.
- [CVE-2026-44229] Fix a cross-site scripting via uploaded content that is
served inline rather than as an attachment.
- [CVE-2026-41073] Fix a spreadsheet (CSV/formula) injection via ticket
values that are exported to a spreadsheet from search results.
User-controlled data is not sanitized before being written to the output
file, which can cause spreadsheet applications such as Microsoft Excel to
interpret crafted values as formulas or macros when the file is opened.
* Drop patches no longer needed:
- fix-WWW::Mechanize_v2.20_in_tests.diff
- add-missing-rt-base-require.diff
- fix-gnupg-2.4.9.diff
* Drop redundant lintian overrides for rt5-doc-html.
* Add missing ".service" to ordering lines in request-tracker5.service
(Closes: #1109102).
Checksums-Sha1:
e5093bb25b63de927f3ad8ee45c63a71cb5bd479 6043
request-tracker5_5.0.10+dfsg-1.dsc
9d52e5a1ac16031ff980255d305111b92a460ecd 3272041
request-tracker5_5.0.10+dfsg.orig-third-party-source.tar.gz
25af636b934a4d4b4b5c7a463ca86ca0da8396e9 20421256
request-tracker5_5.0.10+dfsg.orig.tar.gz
29b447d29b111c8e7188fc42dce0c30da1a1e377 127216
request-tracker5_5.0.10+dfsg-1.debian.tar.xz
b768f634f97b20fffd99b8dcc32df9603da8e9cf 24544
request-tracker5_5.0.10+dfsg-1_amd64.buildinfo
Checksums-Sha256:
d5bb01744f4f339fbe581ec9f89c2c21d857c2eb025add8ec2245c47a72585fe 6043
request-tracker5_5.0.10+dfsg-1.dsc
27d55bce87baa6ab475e18c5edfa2f7b2f5e0ce12e1c28ef3f8a1d71d793d41b 3272041
request-tracker5_5.0.10+dfsg.orig-third-party-source.tar.gz
508b8d401273da4fe1c47e642ecb6017939ef560e9cfdfeb8d18ef41e4dbc5e6 20421256
request-tracker5_5.0.10+dfsg.orig.tar.gz
3ebe256c6f8771255dce30d7f198f8c757bc7f815e0f9cc22693df31529a1281 127216
request-tracker5_5.0.10+dfsg-1.debian.tar.xz
b31b4d5c1e2d53274e4ef4eaedc87d81aec303c561af3885b7481b36d988a7fb 24544
request-tracker5_5.0.10+dfsg-1_amd64.buildinfo
Files:
2739defaabd822a4a7419cd9fd0c180d 6043 misc optional
request-tracker5_5.0.10+dfsg-1.dsc
faabbe44f7ed2bac50d69295184cb285 3272041 misc optional
request-tracker5_5.0.10+dfsg.orig-third-party-source.tar.gz
c9bf647dd3fbd8d949c1c036e3f64042 20421256 misc optional
request-tracker5_5.0.10+dfsg.orig.tar.gz
ecfd60ee3fd6cd1ac6e10cf88c3e1fa2 127216 misc optional
request-tracker5_5.0.10+dfsg-1.debian.tar.xz
924b08fc6451dc3d338caa3d9a0a5f39 24544 misc optional
request-tracker5_5.0.10+dfsg-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEExgP8TmAPHOzRyNl8S1PZMeTT6GMFAmoO8XwACgkQS1PZMeTT
6GMguQ//ZvGtSyWciJmd/ndegMN+bPOBKuhmQg/qyGfRA+pA5TAfk1ftnNPHeIrK
8FTZ170/Fm7frF27BqrkumVFnhjVjkzX3LzZvaAr+bQQSANjl76S2xmjrAFkbLUn
jgmdxyIprEv5Vod4rx34odpYpfFxPmZcBz3tHI5VXJvsTD/UI6Kb2ogDnFBXMaHh
7EgiYMCNIYvmWwdc21pbkgEu/s6ItBMcfRIH4b8tLnVBk331KpC6rO5yETvXqNCL
7xurAxVp3L8YvKqfyHFa4llX8b7hnAU8hogIuoUjeAkZ041Vc5yJUPbXbKXuD4cw
PIVaVchTTgIt4MJzyvqwkX1RPbAm6DIJCM4yMA4StP41zp0piq+2iv/Z1u0Mj2Ol
mWOO3J5MtXgTZKwle9cX/OdEn5AJSgvi0RIv8oGtqly0lwSUtzNHg3sJbmwNiWSr
Fw2kNA0Anigh808zdWL902zTTl2m6euEgmFhfaZcQBH2c6/AXpj7uBlr6qL3bwnS
P5bYLrq6D2XuOQIj0qWIVRjHBrBpwxNx0pQwVR7bdWDVCv65g3Rl+9BeatdyrGhn
KC18fFd0d1pq6Y87v7CyYcASJUZKtoqjU2pJwcUpOK57YBB1XzTxv0fNIqZxbFxg
iZI6kIzKEqJwj/50b4rOq3wkcllANc2qObCp+HoUNTzulxS1D8E=
=eUdl
-----END PGP SIGNATURE-----
pgpPT9X4teiwn.pgp
Description: PGP signature
--- End Message ---
