Package: request-tracker3.8 Version: 3.8.8-6 Severity: grave Tags: security Justification: user security hole
Quoting from DSA 2150-1: It was discovered that Request Tracker, an issue tracking system, stored passwords in its database by using an insufficiently strong hashing method. If an attacker would have access to the password database, he could decode the passwords stored in it. For the stable distribution (lenny), this problem has been fixed in version 3.6.7-5+lenny5. The testing distribution (squeeze) will be fixed soon. For the unstable distribution (sid), this problem has been fixed in version 3.8.8-7 of the request-tracker3.8 package. More info at http://lists.bestpractical.com/pipermail/rt-announce/2011-January/000185.html -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
