DLA-3551-1

CVE-2019-13458 CVE-2019-16375 CVE-2019-18179 CVE-2019-18180 CVE-2020-1765 CVE-2020-1766 CVE-2020-1767 CVE-2020-1769 CVE-2020-1770 CVE-2020-1771 CVE-2020-1772 CVE-2020-1773 CVE-2020-1774 CVE-2020-1776 CVE-2020-11022 CVE-2020-11023 CVE-2021-21252 CVE-2021-21439 CVE-2021-21440 CVE-2021-21441 CVE-2021-21443 CVE-2021-36091 CVE-2021-36100 CVE-2021-41182 CVE-2021-41183 CVE-2021-41184 CVE-2022-4427 CVE-2023-38060 Debian Bug : 945251 959448 980891 989992 991593

Multiple vulnerabilities were found in otrs2, the Open-Source Ticket Request System, which could lead to impersonation, denial of service, information disclosure, or execution of arbitrary code.

CVE-2019-11358

A Prototype Pollution vulnerability was discovered in OTRS' embedded
jQuery 3.2.1 copy, which could allow sending drafted messages as
wrong agent.

This vulnerability is also known as OSA-2020-05.

CVE-2019-12248

Matthias Terlinde discovered that when an attacker sends a malicious
email to an OTRS system and a logged in agent user later quotes it,
the email could cause the browser to load external image resources.

A new configuration setting ‘Ticket::Frontend::BlockLoadingRemoteContent’
has been added as part of the fix.  It controls whether external
content should be loaded, and it is disabled by default.

This vulnerability is also known as OSA-2019-08.

CVE-2019-12497

Jens Meister discovered that in the customer or external frontend,
personal information of agents, like Name and mail address in
external notes, could be disclosed.

New configuration settings ‘Ticket::Frontend::CustomerTicketZoom###DisplayNoteFrom’
has been added as part of the fix.  It controls if agent information
should be displayed in external note sender field, or be substituted
with a different generic name.  Another option named...