Security Advisory 2020-10, Security Advisory 2020-09, Security Advisory 2020-08, Security Advisory 2020-07, Security Advisory 2020-06

Bernd Maus <[email protected]> Fri, 27 Mar 2020 10:13:33 +0100
Newsgroups gmane.comp.otrs.announce
Message-ID <[email protected]> 
--===============1620014257029391710==
Content-Type: multipart/signed;
	boundary="Apple-Mail=_3990D6D6-50DE-4081-A166-75B9CF653F97";
	protocol="application/pkcs7-signature";
	micalg=sha-256


--Apple-Mail=_3990D6D6-50DE-4081-A166-75B9CF653F97
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8



+++++++++ Security Advisory 2020-10: Security Update for OTRS Framework =
+++++++++



Releases:        OTRS 7.0.x, ((OTRS)) Community Edition 6.0.x, ((OTRS)) =
Community Edition 5.0.x
Release date:  27-March-2020
Status:             Patch Level Release

SECURITY FIXES:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =20
------------------------------------------------------------------
OTRS Security Advisory 2020-10           <security at otrs.org>
------------------------------------------------------------------
ID:                OSA-2020-10
Date:            2020-03-27
Title:             Session / Password token leak
Severity:       7.3 HIGH
Product:       OTRS 7.0.x, ((OTRS)) Community Edition 6.0.x, ((OTRS)) =
Community Edition 5.0.x
Fixed in:       OTRS 7.0.16, ((OTRS)) Community Edition 6.0.27, ((OTRS)) =
Community Edition 5.0.42=20
References: CVE-2020-1773


To read the entire Security Advisory please follow this link.

https://community.otrs.com/security-advisory-2020-10



+++++++++ Security Advisory 2020-09: Security Update for OTRS Framework =
+++++++++



Releases:        OTRS 7.0.x, ((OTRS)) Community Edition 6.0.x, ((OTRS)) =
Community Edition 5.0.x
Release date:  27-March-2020
Status:             Patch Level Release

SECURITY FIXES:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =20
------------------------------------------------------------------
OTRS Security Advisory 2020-09           <security at otrs.org>
------------------------------------------------------------------
ID:                OSA-2020-09
Date:            2020-03-27
Title:             Information Disclosure
Severity:       6.5 MEDIUM
Product:       OTRS 7.0.x, ((OTRS)) Community Edition 6.0.x, ((OTRS)) =
Community Edition 5.0.x
Fixed in:       OTRS 7.0.16, ((OTRS)) Community Edition 6.0.27, ((OTRS)) =
Community Edition 5.0.42=20
References: CVE-2020-1772


To read the entire Security Advisory please follow this link.

https://community.otrs.com/security-advisory-2020-09



+++++++++ Security Advisory 2020-08: Security Update for OTRS Framework =
+++++++++


Releases:        OTRS 7.0.x, ((OTRS)) Community Edition 6.0.x, ((OTRS)) =
Community Edition 5.0.x
Release date:  27-March-2020
Status:             Patch Level Release

SECURITY FIXES:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =20
------------------------------------------------------------------
OTRS Security Advisory 2020-08           <security at otrs.org>
------------------------------------------------------------------
ID:                OSA-2020-08
Date:            2020-03-27
Title:             Possible XSS in Customer user address book
Severity:       4.6 MEDIUM
Product:       OTRS 7.0.x, ((OTRS)) Community Edition 6.0.x,=20
Fixed in:       OTRS 7.0.16, ((OTRS)) Community Edition 6.0.27,=20
References: CVE-2020-1771


To read the entire Security Advisory please follow this link.

https://community.otrs.com/security-advisory-2020-08



+++++++++ Security Advisory 2020-07: Security Update for OTRS Framework =
+++++++++



Releases:        OTRS 7.0.x, ((OTRS)) Community Edition 6.0.x, ((OTRS)) =
Community Edition 5.0.x
Release date:  27-March-2020
Status:             Patch Level Release

SECURITY FIXES:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =20
------------------------------------------------------------------
OTRS Security Advisory 2020-07           <security at otrs.org>
------------------------------------------------------------------
ID:                OSA-2020-07
Date:            2020-03-27
Title:             Information disclosure in support bundle files
Severity:       2.4 LOW
Product:       OTRS 7.0.x, ((OTRS)) Community Edition 6.0.x, ((OTRS)) =
Community Edition 5.0.x
Fixed in:       OTRS 7.0.16, ((OTRS)) Community Edition 6.0.27, ((OTRS)) =
Community Edition 5.0.42=20
References: CVE-2020-1770


To read the entire Security Advisory please follow this link.

https://community.otrs.com/security-advisory-2020-07



+++++++++ Security Advisory 2020-06: Security Update for OTRS Framework =
+++++++++



Releases:        OTRS 7.0.x, ((OTRS)) Community Edition 6.0.x, ((OTRS)) =
Community Edition 5.0.x
Release date:  27-March-2020
Status:             Patch Level Release

SECURITY FIXES:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =20
------------------------------------------------------------------
OTRS Security Advisory 2020-06           <security at otrs.org>
------------------------------------------------------------------
ID:                OSA-2020-06
Date:            2020-03-27
Title:             Autocomplete in the form login screens
Severity:       3.5 LOW
Product:       OTRS 7.0.x, ((OTRS)) Community Edition 6.0.x, ((OTRS)) =
Community Edition 5.0.x
Fixed in:       OTRS 7.0.16, ((OTRS)) Community Edition 6.0.27, ((OTRS)) =
Community Edition 5.0.42=20
References: CVE-2020-1769


To read the entire Security Advisory please follow this link.

https://community.otrs.com/security-advisory-2020-06







Bernd Maus
=E2=80=94
Online Marketing Manager

OTRS AG
Zimmersm=C3=BChlenweg 11
61440 Oberursel
Germany

T: +49 6172 681988-44
F: +49 9421 56818-18
I:  https://www.otrs.com/

Business location: Oberursel, Country Court: Bad Homburg, HRB 10751, VAT =
ID: DE256610065
Chairman: Burchard Steinbild, Managing Board: Andr=C3=A9 Mindermann =
(CEO), Christopher Kuhn, Sabine Riedel

OTRS 8 | Fast =E2=80=A2 Modern =E2=80=A2 Secure=20
Learn more.

OTRS is a SERVIEW CERTIFIEDTOOL.   =20


--Apple-Mail=_3990D6D6-50DE-4081-A166-75B9CF653F97
Content-Disposition: attachment;
	filename=smime.p7s
Content-Type: application/pkcs7-signature;
	name=smime.p7s
Content-Transfer-Encoding: base64

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCC7Aw
ggVaMIIEQqADAgECAhADUMJmoO2Kn/DzGKLM0R0SMA0GCSqGSIb3DQEBCwUAMGUxCzAJBgNVBAYT
AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi
BgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQTAeFw0xODA0MjUwMDAwMDBaFw0yMTA0
MjUxMjAwMDBaMH0xCzAJBgNVBAYTAkRFMQ8wDQYDVQQIEwZIZXNzZW4xEjAQBgNVBAcTCU9iZXJ1
cnNlbDEQMA4GA1UEChMHT1RSUyBBRzETMBEGA1UEAxMKQmVybmQgTWF1czEiMCAGCSqGSIb3DQEJ
ARYTYmVybmQubWF1c0BvdHJzLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAO6P
VRT5fldOhfQZij1tCDRwZpc9vkpZ9LmQAvCae4baJW+udnEgx0eb7ohrc9km9GK6xNaazd/CrzBs
aAg+JnBl9hkNZ38Nu/NlrDMjSFRno5TNY1W0SreRQ+s9pNlGAS6/7mh/HWvFT2vojoM0ELz/oua0
qVP4Avzo75aeURS+8XP8VGqnV9tpDtQJrgRR39mF06vQ9Z1nkva+fMZ6IF30wluReUjZhtCthTJN
5zDxTFxqeujygprI0LnvLgLPBrDLEnxrcV+PdzZkQjJ7fjBqdctTWoo9MXebGGM20T845HO/upN+
6+XxZl1zRxZLykmksijC8KmtbvnBuQ1JC8ECAwEAAaOCAewwggHoMB8GA1UdIwQYMBaAFOcCI4AA
T9jXvJQL2T90OUkyPIp5MB0GA1UdDgQWBBQ41AY/AY0wYer5aztviVBc+5sm6TAMBgNVHRMBAf8E
AjAAMB4GA1UdEQQXMBWBE2Jlcm5kLm1hdXNAb3Rycy5jb20wDgYDVR0PAQH/BAQDAgWgMB0GA1Ud
JQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDBDBgNVHSAEPDA6MDgGCmCGSAGG/WwEAQIwKjAoBggr
BgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCBiAYDVR0fBIGAMH4wPaA7oDmG
N2h0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJBc3N1cmVkSURDQS1nMi5jcmww
PaA7oDmGN2h0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJBc3N1cmVkSURDQS1n
Mi5jcmwweQYIKwYBBQUHAQEEbTBrMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5j
b20wQwYIKwYBBQUHMAKGN2h0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJB
c3N1cmVkSURDQS5jcnQwDQYJKoZIhvcNAQELBQADggEBAKZ0RxEruHZXIGhElcFvvjbHQp+gPkLV
evB89GaeqAZwB/JrNlmJb1sATzwXPBH7b+Rwg2yuUnrxm/Yqyd5/yJWIJ6tw6EEhvv+VnCxWrFzN
jeRh9RLzdf7nU98RlyQrVfxoxVDaHhvwbzj3Ncbqj8LkJ+dkgNP0tafwnfnZPU4Ty9EuCBaAAbaq
lArSlWpzXRcsX33uh7ALq0vA4UTzjturRzfgduauCWsXB1h0lwfQYoMvq9wubIBWvsRrdPbiRNIm
DAFs3KmHPkwesJUPL76TxB7FNlNUJeaZWOLScj/B4w3WGgX/AIQHCbuj0ucKMSOmpa5d3OC0qU8n
GCoxeYswggZOMIIFNqADAgECAhAErnlgZmaQGrnFf6ZsW9zNMA0GCSqGSIb3DQEBCwUAMGUxCzAJ
BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j
b20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0xMzExMDUxMjAwMDBa
Fw0yODExMDUxMjAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAX
BgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJ
RCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANz4ESM/arXvwCd5Gy0Fh6IQQzHf
DtQVG093pCLOPoxw8L4Hjt0nKrwBHbYsCsrdaVgfQe1qBR/aY3hZHiIsK/i6fsk1O1bxH3xCfiWw
IxnGRTjXPUT5IHxgrhywWhgEvo8796nwlJqmDGNJtkEXU0AyvU/mUHpQHyVF6PGJr83/Xv9Q8/AX
Ef+9xYn1vWK52PuORQSFbZnNxUhN/SarAjZF6jbXX2riGoJBCtzp2fWRF47GIa04PBPmHn9mnNVN
2Uba9s9Sp307JMO0wVE1xpvr1O9+5HsD4US9egs34E/LgooNcRjkpuCJLBvzsnM8wbCSnhh9vat9
xX0IoSzCn3MCAwEAAaOCAvgwggL0MBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGG
MDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMIGB
BgNVHR8EejB4MDqgOKA2hjRodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVk
SURSb290Q0EuY3JsMDqgOKA2hjRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1
cmVkSURSb290Q0EuY3JsMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDCCAbMGA1UdIASC
AaowggGmMIIBogYKYIZIAYb9bAACBDCCAZIwKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LmRpZ2lj
ZXJ0LmNvbS9DUFMwggFkBggrBgEFBQcCAjCCAVYeggFSAEEAbgB5ACAAdQBzAGUAIABvAGYAIAB0
AGgAaQBzACAAQwBlAHIAdABpAGYAaQBjAGEAdABlACAAYwBvAG4AcwB0AGkAdAB1AHQAZQBzACAA
YQBjAGMAZQBwAHQAYQBuAGMAZQAgAG8AZgAgAHQAaABlACAARABpAGcAaQBDAGUAcgB0ACAAQwBQ
AC8AQwBQAFMAIABhAG4AZAAgAHQAaABlACAAUgBlAGwAeQBpAG4AZwAgAFAAYQByAHQAeQAgAEEA
ZwByAGUAZQBtAGUAbgB0ACAAdwBoAGkAYwBoACAAbABpAG0AaQB0ACAAbABpAGEAYgBpAGwAaQB0
AHkAIABhAG4AZAAgAGEAcgBlACAAaQBuAGMAbwByAHAAbwByAGEAdABlAGQAIABoAGUAcgBlAGkA
bgAgAGIAeQAgAHIAZQBmAGUAcgBlAG4AYwBlAC4wHQYDVR0OBBYEFOcCI4AAT9jXvJQL2T90OUky
PIp5MB8GA1UdIwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMA0GCSqGSIb3DQEBCwUAA4IBAQBO
1Iknuf0dh3d+DygFkPEKL8k7Pr2TnJDGr/qRUYcyVGvoysFxUVyZjrX64GIZmaYHmnwTJ9vlAqKE
EtkV9gpEV8Q0j21zHzrWoAE93uOC5EVrsusl/YBeHTmQvltC9s6RYOP5oFYMSBDOM2h7zZOr8GrL
T1gPuXtdGwSBnqci4ldJJ+6Skwi+aQhTAjouXcgZ9FCATgLZsF2RtJOH+ZaWgVVAjmbtgti7KF/t
TGHtBlgoGVMRRLxHICmyBGzYiVSZO3XbZ3gsHpJ4xlU9WBIRMm69QwxNNNt7xkLb7L6rm2FMBpLj
jt8hKlBXBMBgojXVJJ5mNwlJz9X4ZbPg4m7CMYIDKTCCAyUCAQEweTBlMQswCQYDVQQGEwJVUzEV
MBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQD
ExtEaWdpQ2VydCBTSEEyIEFzc3VyZWQgSUQgQ0ECEANQwmag7Yqf8PMYoszRHRIwDQYJYIZIAWUD
BAIBBQCgggGBMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTIwMDMy
NzA5MTMzM1owLwYJKoZIhvcNAQkEMSIEIOePNKMBEOr1qZ1VMv74I7rX8Ew+eVzxLJMXgeB/1FDO
MIGIBgkrBgEEAYI3EAQxezB5MGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMx
GTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJl
ZCBJRCBDQQIQA1DCZqDtip/w8xiizNEdEjCBigYLKoZIhvcNAQkQAgsxe6B5MGUxCzAJBgNVBAYT
AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi
BgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQQIQA1DCZqDtip/w8xiizNEdEjANBgkq
hkiG9w0BAQEFAASCAQCmwXL8Wu72vcSB5qUMZZqlJBgPOetqD2B7z/lhb66jtR6OYN+MEbQd5J4X
PSGNpJBPB8+AZ7HkPK+D3O3doXHtb95HK7DZfVi3KzN0V0Op5LZyc/kGCcTWCj+hyWbbqcget0iS
iD8zSNicG3AGI2XcqkVI8bsFsMsvJWk2+nnOrL8KDL7iscgyCvV9bPRybJ5aY0bUE5oRdWaxOisU
82jrESPNWSO1aDUBGOkgRsbnPUgYTkUCOa1w0z+E1IrCsEoiI72Ds7k3udjc4hOD6d/PhqGE3jfg
3B5LvlPUxUTE6Bl9yDISy3hIGLxipylqXIjJ42p8veAV+t3CEBcIWb2QAAAAAAAA
--Apple-Mail=_3990D6D6-50DE-4081-A166-75B9CF653F97--

--===============1620014257029391710==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

---------------------------------------------------------------------
OTRS mailing list: announce - Webpage: http://otrs.org/
Archive: http://lists.otrs.org/pipermail/announce
To unsubscribe: http://lists.otrs.org/mailman/listinfo/announce

--===============1620014257029391710==--