{"id":"CVE-2025-2545","aliases":["DEBIAN-CVE-2025-2545","DLA-4157-1","DSA-5909-1","DSA-5911-1","EUVD-2025-13369","GHSA-33cx-2vvq-mf52","UBUNTU-CVE-2025-2545","USN-7692-1"],"status":"published","title":"Deprecated 3DES cryptographic algorithm used by Request Tracker in emails encrypted with S/MIME","description":"Vulnerability in Best Practical Solutions, LLC's Request Tracker prior to v5.0.8, where the Triple DES (3DES) cryptographic algorithm is used to protect emails sent with S/MIME encryption. Triple DES is considered obsolete and insecure due to its susceptibility to birthday attacks, which could compromise the confidentiality of encrypted messages.","severity":{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00194,"percentile":0.09085,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-327"],"published":"2025-04-30T00:00:00Z","modified":"2026-09-01T20:05:44Z","fixes":[{"ecosystem":"Debian:12","package":"request-tracker4","fixed_in":["4.4.6+dfsg-1.1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"request-tracker5","fixed_in":["5.0.3+dfsg-3~deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"request-tracker5","fixed_in":["5.0.7+dfsg-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"request-tracker5","fixed_in":["5.0.7+dfsg-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"request-tracker5","fixed_in":["5.0.1+dfsg-1ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"request-tracker5","fixed_in":["5.0.5+dfsg-2ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6+dfsg-1.1+deb12u2"}]}],"versions":["4.4.6+dfsg-1.1","4.4.6+dfsg-1.1+deb12u1"]},{"source":"osv","ecosystem":"Debian:12","package":"request-tracker5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3+dfsg-3~deb12u3"}]}],"versions":["5.0.3+dfsg-2","5.0.3+dfsg-3~deb12u1","5.0.3+dfsg-3~deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"request-tracker5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.7+dfsg-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"request-tracker5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.7+dfsg-3"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4+dfsg-2+deb11u4"}]}],"versions":["4.4.4+dfsg-2","4.4.4+dfsg-2+deb11u1","4.4.4+dfsg-2+deb11u2","4.4.4+dfsg-2+deb11u3"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"request-tracker5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3+dfsg-3~deb12u3"}]}],"versions":["5.0.3+dfsg-2","5.0.3+dfsg-3~deb12u1","5.0.3+dfsg-3~deb12u2"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6+dfsg-1.1+deb12u2"}]}],"versions":["4.4.6+dfsg-1.1","4.4.6+dfsg-1.1+deb12u1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.11-2","4.2.12-3","4.2.12-4","4.2.12-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-5","4.4.2-1","4.4.2-2","4.4.2-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.3-2","4.4.3-2+deb10u3build0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.4+dfsg-2ubuntu1","4.4.4+dfsg-2ubuntu1.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"request-tracker5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1+dfsg-1ubuntu1+esm1"}]}],"versions":["5.0.1+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.4+dfsg-2ubuntu1","4.4.4+dfsg-2ubuntu2","4.4.7+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"request-tracker5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5+dfsg-2ubuntu0.1~esm1"}]}],"versions":["5.0.1+dfsg-1ubuntu1","5.0.5+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.7+dfsg-4syncable1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"request-tracker4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.7+dfsg-4syncable1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"request-tracker5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1+dfsg-1ubuntu1+esm1"}]}],"versions":["5.0.1+dfsg-1ubuntu1"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"request-tracker5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5+dfsg-2ubuntu0.1~esm1"}]}],"versions":["5.0.1+dfsg-1ubuntu1","5.0.5+dfsg-2"],"bundled":11}],"products":[{"vendor":"best practical solutions","product":"request tracker"},{"vendor":"bestpractical","product":"request tracker"}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/cryptographic-algorithm-not-recommended-request-tracker-best-practical","tags":["web"]},{"url":"https://docs.bestpractical.com/release-notes/rt/4.4.8","tags":["web"]},{"url":"https://docs.bestpractical.com/release-notes/rt/5.0.8","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00009.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2545"},{"url":"https://github.com/advisories/GHSA-33cx-2vvq-mf52"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-2545","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-2545","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-2545","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7692-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-38562","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-25802","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-25803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-41259","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-41260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-45024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-3262","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-30087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-31500","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-31501","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-2545","title":"Deprecated 3DES cryptographic algorithm used by Request Tracker in emails encrypted with S/MIME","description":"Vulnerability in Best Practical Solutions, LLC's Request Tracker prior to v5.0.8, where the Triple DES (3DES) cryptographic algorithm is used to protect emails sent with S/MIME encryption. Triple DES is considered obsolete and insecure due to its susceptibility to birthday attacks, which could compromise the confidentiality of encrypted messages.","status":"published","published":"2025-05-05T11:28:43.668Z","modified":"2025-11-03T19:45:04.026Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:32:38.70481Z"}],"euvd":[{"id":"EUVD-2025-13369","description":"Vulnerability in Best Practical Solutions, LLC's Request Tracker prior to v5.0.8, where the Triple DES (3DES) cryptographic algorithm is used to protect emails sent with S/MIME encryption. Triple DES is considered obsolete and insecure due to its susceptibility to birthday attacks, which could compromise the confidentiality of encrypted messages.","status":"published","published":"2025-05-05T11:28:43Z","modified":"2025-11-03T19:45:04Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T19:49:33.269212Z"}],"ghsa":[{"id":"GHSA-33cx-2vvq-mf52","title":"Vulnerability in Best Practical Solutions, LLC's Request Tracker v5.0.7, where the Triple DES ...","description":"Vulnerability in Best Practical Solutions, LLC's Request Tracker v5.0.7, where the Triple DES (3DES) cryptographic algorithm is used within SMIME code to encrypt S/MIME emails. Triple DES is considered obsolete and insecure due to its susceptibility to birthday attacks, which could compromise the confidentiality of encrypted messages.","status":"published","published":"2025-05-05T12:30:34Z","modified":"2025-11-03T21:34:51Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T15:04:24.938946Z"}],"nvd":[{"id":"CVE-2025-2545","description":"Vulnerability in Best Practical Solutions, LLC's Request Tracker prior to v5.0.8, where the Triple DES (3DES) cryptographic algorithm is used to protect emails sent with S/MIME encryption. Triple DES is considered obsolete and insecure due to its susceptibility to birthday attacks, which could compromise the confidentiality of encrypted messages.","status":"published","published":"2025-05-05T12:15:16.17Z","modified":"2026-06-17T09:07:09.007Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:11:04.33372Z"}],"osv":[{"id":"DEBIAN-CVE-2025-2545","description":"Vulnerability in Best Practical Solutions, LLC's Request Tracker prior to v5.0.8, where the Triple DES (3DES) cryptographic algorithm is used to protect emails sent with S/MIME encryption. Triple DES is considered obsolete and insecure due to its susceptibility to birthday attacks, which could compromise the confidentiality of encrypted messages.","status":"published","published":"2025-05-05T12:15:16.17Z","modified":"2026-09-01T20:05:44.908250203Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"UBUNTU-CVE-2025-2545","description":"Vulnerability in Best Practical Solutions, LLC's Request Tracker prior to v5.0.8, where the Triple DES (3DES) cryptographic algorithm is used to protect emails sent with S/MIME encryption. Triple DES is considered obsolete and insecure due to its susceptibility to birthday attacks, which could compromise the confidentiality of encrypted messages.","status":"published","published":"2025-05-05T12:15:00Z","modified":"2026-05-20T16:21:00.410714426Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"CVE-2025-2545","description":"Vulnerability in Best Practical Solutions, LLC's Request Tracker prior to v5.0.8, where the Triple DES (3DES) cryptographic algorithm is used to protect emails sent with S/MIME encryption. Triple DES is considered obsolete and insecure due to its susceptibility to birthday attacks, which could compromise the confidentiality of encrypted messages.","status":"published","published":"2025-05-05T12:15:16Z","modified":"2026-04-10T05:23:16.785553Z","updated_at":"2026-11-02T15:44:47.386092Z"},{"id":"DLA-4157-1","title":"request-tracker4 - security update","status":"published","published":"2025-05-08T00:00:00Z","modified":"2026-03-09T02:09:38.982165Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5909-1","title":"request-tracker5 - security update","status":"published","published":"2025-04-30T00:00:00Z","modified":"2026-03-09T02:10:42.105011Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"DSA-5911-1","title":"request-tracker4 - security update","status":"published","published":"2025-04-30T00:00:00Z","modified":"2026-03-09T02:10:05.930403Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"USN-7692-1","title":"request-tracker5 vulnerabilities","description":"It was discovered that Request Tracker was susceptible to timing\nattacks. An attacker could possibly use this issue to access sensitive\ninformation. This issue only affected Ubuntu 22.04 LTS. (CVE-2021-38562)\n\nIt was discovered that Request Tracker was susceptible to cross-site\nscripting attacks when malicious attachments were supplied. An attacker\ncould possibly use this issue to execute arbitrary code. This issue\nonly affected Ubuntu 22.04 LTS. (CVE-2022-25802)\n\nIt was discovered that Request Tracker would incorrectly redirect users\nin certain instances. An attacker could possibly use this issue to\ncause a denial of service. This issue only affected Ubuntu 22.04 LTS.\n(CVE-2022-25803)\n\nTom Wolters discovered that Request Tracker could leak information when\nmalicious email headers were supplied. An attacker could possibly\nuse this issue to access sensitive information. This issue only\naffected Ubuntu 22.04 LTS. (CVE-2023-41259, CVE-2023-41260)\n\nIt was discovered that Request Tracker could leak information through\nits transaction search. An attacker with access to the transaction\nquery builder of Request Tracker could possibly use this issue to\naccess sensitive information. This issue only affected Ubuntu 22.04\nLTS. (CVE-2023-45024)\n\nIt was discovered that Request Tracker erroneously stored ticket\ninformation in a web browser's cache. An attacker with direct access to\na system could possibly use this issue to access sensitive information.\nThis issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.\n(CVE-2024-3262)\n\nIt was discovered that Request Tracker made use of an obsolete\ncryptographic algorithm for emails sent with S/MIME encryption. An\nattacker could possibly use this issue to access sensitive information.\n(CVE-2025-2545)\n\nIt was discovered that Request Tracker was susceptible to cross-site\nscripting attacks when malicious parameters were included in a search\nURL. An attacker could possibly use this issue to execute arbitrary\ncode. (CVE-2025-30087)\n\nIt was discovered that Request Tracker was susceptible to cross-site\nscripting attacks when malicious permalinks or assets were provided.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2025-31500, CVE-2025-31501)","status":"published","published":"2025-08-13T15:40:22Z","modified":"2026-04-27T17:59:58.480559Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}