Fedora 43 Request Tracker 5.0.10 Update Patches Seven CVEs — Detection and Remediation Guide

Fedora has shipped rt 5.0.10 for Fedora 43, a security update to Request Tracker — the widely deployed open-source ticketing and incident-tracking platform from Best Practical — that resolves seven CVEs in a single release: CVE-2025-61873, CVE-2026-41075, CVE-2026-41076, CVE-2026-6841, CVE-2026-44229, CVE-2026-44230, and CVE-2026-44231.

This matters well beyond the Fedora user base. Request Tracker is not a niche application — it sits at the heart of many SOCs, CERTs, abuse desks, and IT service operations. It is the system of record for incident handling, which means it routinely holds exactly the data an attacker wants: incident timelines, indicators of compromise, internal communications, credentials accidentally pasted into tickets, and customer PII. Seven patched flaws in one update against an internet-facing, Perl-based web application is a signal defenders should not ignore.

If your organization runs Request Tracker on Fedora 43 — or tracks upstream RT releases for a self-managed deployment — treat this as a priority patch cycle. Ticketing systems are high-value targets precisely because defenders trust them.

Technical Analysis

Affected products and platforms

• Product: Request Tracker (rt), Best Practical's web-based ticketing platform
• Fixed version: rt 5.0.10
• Distribution: Fedora 43 (package rt), per the advisory published via LinuxSecurity
• Architectures: all Fedora 43 supported architectures
• Deployment context: RT is typically deployed behind Apache or nginx using mod_perl, FastCGI, or PSGI/Plack, backed by MySQL/MariaDB or PostgreSQL — which means the attack surface is the full web stack plus its database tier

CVEs addressed

At the time of writing, individual CVSS scores and per-CVE technical write-ups should be pulled directly from NVD and the upstream Best Practical release notes for 5.0.10 — do not rely on secondary summaries for severity triage. What we can say with confidence from a defender's perspective:

1. Seven flaws in one point release is unusual. Historically, RT security releases have addressed issues across a consistent set of vulnerability classes: improper input validation leading to injection, cross-site scripting in ticket rendering, information disclosure across queue/permission boundaries, and authentication/session handling weaknesses. Defenders should assume the fixed set spans similar classes until per-CVE advisories confirm otherwise.
2. RT is a privileged-position application. It integrates with mail gateways (inbound ticket creation via rt-mailgate), LDAP/SSO for authentication, and often has outbound API integrations. A compromise of RT is not just data loss — it is a foothold adjacent to your IR workflow, your mail flow, and frequently your directory.
3. Exploitation requirements are typically low. As a web application, RT flaws in the injection/XSS/disclosure classes generally require nothing more than network access to the web interface — and in the case of stored XSS or mail-driven ticket creation, potentially just the ability to send an email to the ticket gateway address.

Exploitation status

The Fedora advisory itself is a patch notification; it does not report confirmed in-the-wild exploitation, and none of these identifiers appear on the CISA Known Exploited Vulnerabilities catalog as of this writing. That said, two realities argue for urgency rather than complacency:

• Patch-diffing is standard attacker tradecraft. The moment an open-source project ships a security release, the diff between 5.0.9 and 5.0.10 becomes a roadmap to the vulnerable code paths. Public PoCs for RT-class web flaws routinely follow within days of disclosure.
• Unauthenticated attack surface is the norm for RT. Ticket creation by email and self-service portals mean portions of RT are deliberately exposed to untrusted input by design.

Treat this as "exploitable, not yet confirmed exploited" and patch accordingly.

Detection & Response

Because these are web-application flaws in a Perl platform fronted by Apache/nginx, detection efforts should concentrate on three observables: anomalous requests against RT paths in web access logs, the web server process spawning unexpected child processes, and integrity/version drift of the RT installation itself.

---
title: Web Server Process Spawning Shell or System Tools on RT Host
id: 3f8c1a92-6b47-4d5e-9a21-7c4e5f0a1b2d
status: experimental
description: Detects Apache/nginx worker processes spawning shells, downloaders, or reconnaissance tools on a host running Request Tracker. Web-facing Perl applications under active exploitation commonly result in the web daemon user executing system commands. Investigate immediately in the context of the rt 5.0.10 patch cycle.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-43-rt
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/httpd'
      - '/apache2'
      - '/nginx'
      - '/perl'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
  condition: selection_parent and selection_child
falsepositives:
  - rt-mailgate and legitimate RT CLI invocations run as the web or rt user; baseline and exclude known cron/handler paths
  - Monitoring agents executing under the web server context
level: high
---
title: Suspicious Request Patterns Against Request Tracker Endpoints
id: 9d2e7b41-3c58-4f6a-b8e4-1a5c6d9e2f07
status: experimental
description: Detects SQL injection probes, path traversal, and template/code injection patterns in web access log URIs targeting Request Tracker paths. Correlates with exploitation attempts against web-application flaws of the classes commonly patched in RT security releases.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-43-rt
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri|contains:
      - '/rt/'
      - '/REST/'
      - '/Ticket/'
      - '/Search/'
  selection_attack:
    cs-uri|contains:
      - '%27'
      - 'UNION'
      - 'SELECT'
      - '../'
      - '..%2f'
      - '%3cscript'
      - '<script'
      - 'sleep('
      - 'benchmark('
  condition: selection_path and selection_attack
falsepositives:
  - Vulnerability scanners and authorized penetration tests; tune against known scanner source IPs
  - Ticket subject lines containing quoted strings passed through the REST interface
level: medium

// Hunt for suspicious requests against Request Tracker paths ingested via Syslog/CEF
// Scope to your RT web tier hosts. Look for injection patterns, abnormal response codes,
// and high request volume from single sources against /rt/, /Ticket/, /Search/, /REST/.
let rt_paths = dynamic(["/rt/", "/Ticket/", "/Search/", "/REST/", "/NoAuth/"]);
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any (rt_paths)
| where RequestURL has_any ("%27", "UNION", "SELECT", "../", "..%2f", "%3cscript", "<script", "sleep(", "benchmark(")
    or (RequestURL has_any (rt_paths) and toint(ReceivedBytes) > 100000)
| summarize RequestCount = count(),
            DistinctURIs = dcount(RequestURL),
            SampleURIs = make_set(RequestURL, 10)
  by SourceIP, DestinationHostName, DeviceAction
| where RequestCount > 50 or DistinctURIs > 20
| order by RequestCount desc;
// Secondary hunt: process execution under the web daemon context on RT hosts (via Syslog/auditd)
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_all ("httpd", "execve")
   or SyslogMessage has_all ("www-data", "/bin/sh")
   or SyslogMessage has_all ("nginx", "/bin/bash")
| project TimeGenerated, Computer, SyslogMessage
| order by TimeGenerated desc;

-- Artifact: Linux.Hunt.RequestTrackerExposure
-- Hunt for (1) RT version/state on the host, (2) web daemon child processes
-- consistent with post-exploitation, and (3) listeners on RT web ports.

-- 1) Identify RT installation version and package state (RPM-based systems)
SELECT * FROM execve(argv=['rpm', '-q', 'rt', '--qf', '%{NAME}-%{VERSION}-%{RELEASE}\n'])

-- 2) Enumerate processes running under the web/RT context and flag
--    children that should not exist (shells, downloaders, interpreters)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Username =~ 'apache|www-data|nginx|rt')
  AND (Exe =~ '/bin/(sh|bash|dash)$'
       OR CommandLine =~ 'curl |wget |nc |ncat |python')

-- 3) Confirm which processes hold listening sockets on the RT web tier
SELECT Pid, Name, Address, Port, Status
FROM netstat()
WHERE Status =~ 'LISTEN'
  AND Port in (80, 443, 8080, 8443)

#!/usr/bin/env bash
# rt 5.0.10 verification and remediation — Fedora 43
# Run as root or via sudo on each RT host.

set -euo pipefail

echo "=== [1/4] Current rt package state ==="
rpm -q rt || { echo "rt package not installed on this host."; exit 0; }

INSTALLED=$(rpm -q rt --qf '%{VERSION}')
echo "Installed rt version: ${INSTALLED}"

echo "=== [2/4] Applying Fedora 43 security update ==="
# Pull only the rt advisory update; review changelogs before deploying to prod
dnf clean expire-cache
dnf updateinfo list --security | grep -i rt || true
dnf update -y rt

echo "=== [3/4] Post-update verification ==="
NEWVER=$(rpm -q rt --qf '%{VERSION}')
echo "rt version after update: ${NEWVER}"
if [ "${NEWVER}" != "5.0.10" ]; then
  echo "WARNING: rt is not at 5.0.10. Investigate repo mirror state before proceeding."
fi

echo "=== [4/4] Service restart and integrity checks ==="
# Restart the web tier so mod_perl/FastCGI reloads patched RT code
systemctl restart httpd 2>/dev/null || systemctl restart nginx 2>/dev/null || true

# Confirm the web daemon is healthy after restart
systemctl is-active --quiet httpd && echo "httpd: active" || systemctl is-active --quiet nginx && echo "nginx: active"

# Audit: look for suspicious child processes spawned by the web user in the last 24h
echo "--- Web-user child process audit (last 24h) ---"
ausearch -ts recent -i 2>/dev/null | grep -E 'httpd|nginx|www-data' | grep -E '/bin/(sh|bash)|curl|wget|nc ' || echo "No suspicious web-context executions found."

echo "Done. Confirm RT web UI and rt-mailgate are functional, then close out the change ticket."

Remediation

1. Patch immediately. On Fedora 43 RT hosts, run dnf update rt and confirm the installed version reports 5.0.10. Restart the web tier (httpd/nginx) afterward — RT under mod_perl or persistent FastCGI/Plack will continue running the old code until the workers recycle.
2. Inventory exposure. Identify every RT instance in the environment, including forgotten test and departmental instances. Determine which are internet-reachable or reachable from untrusted network segments. Prioritize those for same-day patching.
3. Review per-CVE severity. Pull CVE-2025-61873, CVE-2026-41075, CVE-2026-41076, CVE-2026-6841, CVE-2026-44229, CVE-2026-44230, and CVE-2026-44231 from NVD and the upstream Best Practical 5.0.10 release notes to score your actual risk based on your RT configuration (public self-registration, mail gateway exposure, REST API exposure).
4. Hunt before you close the ticket. Run the KQL and VQL content above across your RT web tier for at least the last 14 days. A patched system that was already compromised is still compromised — patching closes the door, it does not evict the intruder. Look specifically for web-context shell spawns, unexpected outbound connections from the RT host, and new local accounts or cron entries.
5. Reduce the attack surface going forward. Restrict administrative RT interfaces to VPN/allowlisted networks, put RT behind a WAF or reverse proxy with request filtering, disable public self-service portals if unused, and ensure rt-mailgate input is treated as hostile (it is).
6. Rotate what RT touches. If there is any evidence of pre-patch compromise, rotate credentials stored in or transiting RT: database credentials in RT_SiteConfig.pm, LDAP bind accounts, mail gateway credentials, and any API tokens issued to integrations.
7. Track the advisory. Source: Fedora 43 rt 5.0.10 security update. Subscribe to the Best Practical security announcement list and Fedora package update notifications so the next RT release does not surprise you.

Ticketing systems are where your incident response happens. An attacker inside your RT is an attacker inside your IR process itself — patch fast, hunt thoroughly, and treat the platform as the tier-one asset it actually is.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub