Bug 638332 (CVE-2017-16664)

Summary:	<www-apps/otrs-5.0.25: Command injection vulnerability
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	trivial	CC:	lists, proxy-maint, web-apps
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	~2 [noglsa cve]
Package list:		Runtime testing required:	---

Description GLSAMaker/CVETool Bot gentoo-dev

2017-11-21 16:27:31 UTC

CVE-2017-16664 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-16664):
  Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request
  System (OTRS) 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. In
  the agent interface, an authenticated remote attackeer can execute shell
  commands as the webserver user via URL manipulation.

Comment 1 Christopher Díaz Riveros (RETIRED) gentoo-dev

2017-11-21 16:39:33 UTC

@Maintainers please let us know when tree is clean from vulnerable versions.

Thank you