Fedora 43 Ships Request Tracker 5.0.10: Patch Seven RT CVEs Including CVE-2025-61873 — Detection and Remediation Guide

Fedora has shipped an update for Request Tracker (RT) 5.0.10 on Fedora 43, resolving seven distinct CVEs: CVE-2025-61873, CVE-2026-41075, CVE-2026-41076, CVE-2026-6841, CVE-2026-44231, CVE-2026-44229, and CVE-2026-44230. The advisory was published through the standard Fedora update channel and is available via DNF.

If you run a self-hosted RT instance on Fedora — and a surprising number of IT service desks, CERTs, and abuse teams do — this is a patch-now event, not a patch-soon event. RT sits at a uniquely sensitive position in most environments: it ingests untrusted email from the internet by design, parses attachments and rich content, stores credentials and internal workflow data, and is frequently reachable from outside the perimeter so that customers and reporters can open tickets. A cluster of seven CVEs landing in a single upstream release is the signature of a coordinated security audit of the codebase — and it means prior versions carry multiple distinct flaws that defenders must assume are documented and differentiable from the patch.

Every one of these CVE identifiers is now public. Patch diffing between 5.0.9 and 5.0.10 is trivially accessible to anyone motivated. The window between "update published" and "exploitation attempted" for internet-facing ticketing systems is measured in days, not weeks.

Technical Analysis

Affected Products and Platforms

• Product: Request Tracker (Best Practical's RT), the Perl-based enterprise ticketing and workflow platform
• Vulnerable versions: RT versions prior to 5.0.10 (Fedora 43 shipped an earlier 5.0.x build)
• Fixed version: rt 5.0.10, delivered via the Fedora 43 updates repository
• Platform: Fedora 43 (x86_64 and other supported architectures); other distributions shipping RT 5.0.x (Debian, RHEL/EPEL rebuilds, container images based on RT upstream) should verify their own package versions against upstream
• Typical deployment stack: RT runs as a Perl web application behind Apache/mod_fcgid, nginx + FastCGI, or PSGI/Plack, backed by MySQL/MariaDB or PostgreSQL, with an rt-mailgate component piping inbound mail directly into ticket creation

The CVE Cluster

The Fedora advisory resolves the following identifiers:

Official NVD CVSS scoring for the 2026 identifiers was still maturing at the time of the Fedora advisory's publication; defenders should pull current scores from NVD and the Best Practical security advisory index rather than waiting for scores to trickle into scanner feeds. Do not let an unscored CVE sit at the bottom of your queue — a vendor-shipped security release bundling seven fixes is itself the severity signal.

Attack Surface: Why RT Is a High-Value Target

From a defender's perspective, RT's risk profile is defined by three properties:

1. Unauthenticated input paths. rt-mailgate accepts email from arbitrary senders and converts it into tickets, comments, and attachments. The web UI exposes self-service portals, and the REST endpoints (/REST/1.0/, /REST/2.0/) are commonly enabled for integrations. Vulnerabilities in parsing, encoding handling, or template rendering in this path are reachable by anyone who can send an email or reach the web port.
2. Stored content execution context. Tickets are rendered to privileged users — agents, admins, SOC staff. A stored-XSS-class flaw in a ticket body or attachment name lands in front of the most privileged users of the application.
3. Data sensitivity. RT instances routinely hold vulnerability reports, incident details, customer PII, password-reset workflows, and internal escalation notes. Confidentiality impact from an RT compromise is consistently underestimated.

Historically, RT security releases have addressed flaw classes including cross-site scripting in ticket rendering, authorization/ACL bypasses in queue and ticket access, injection flaws in search and mail handling, and information disclosure. With seven CVEs fixed simultaneously, defenders should assume coverage across more than one of these classes and treat the pre-patch versions as broadly untrusted for internet exposure.

Exploitation Status

As of this writing, none of CVE-2025-61873, CVE-2026-41075, CVE-2026-41076, CVE-2026-6841, CVE-2026-44231, CVE-2026-44229, or CVE-2026-44230 appear in the CISA Known Exploited Vulnerabilities catalog, and no public in-the-wild exploitation has been confirmed in the Fedora advisory. That is a temporary condition, not a comfort. Public CVE identifiers plus a publicly diffable patch equals a working exploit roadmap for any competent researcher. Prioritize accordingly.

Detection & Response

The realistic detection strategy for a web application like RT is layered: web access log anomalies on RT's URI space, process lineage anomalies under the web server user, and package/version auditing to prove remediation. The detections below are tuned to be high-signal, not exhaustive.

Sigma Rules

---
title: Suspicious Request Patterns Against Request Tracker Web Interface
id: 8b2c4d71-3f5a-4e9b-a1c7-2d8e6f0a4b9c
status: experimental
description: Detects web requests to Request Tracker URI paths containing common exploitation primitives such as path traversal, template injection markers, or encoded payloads. Relevant to the multi-CVE RT 5.0.10 patch cycle where parsing and rendering flaws in ticket/REST paths are plausible.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-perl-encoding-fixlatin
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: linux
detection:
  selection_uri:
    cs-uri|contains:
      - '/Ticket/'
      - '/REST/'
      - '/Search/'
      - '/Ticket/Display.html'
  selection_payload:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '%2e%2e'
      - '<script'
      - '%3Cscript'
      - '{{'
      - 'UNION%20SELECT'
      - 'union+select'
      - 'file='
      - '/etc/passwd'
  condition: selection_uri and selection_payload
falsepositives:
  - Vulnerability scanners and authorized penetration tests against RT
level: high
---
title: Web Server Process Spawning Shell or System Utilities on RT Host
id: 4e7a9c12-8d3b-4f6e-b2a5-9c1d7e3f5a08
status: experimental
description: Detects Apache/nginx/fcgiwrap or RT fcgi processes spawning shells or system utilities, consistent with post-exploitation of a web application flaw such as those patched in RT 5.0.10.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-perl-encoding-fixlatin
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/httpd'
      - '/apache2'
      - '/nginx'
      - '/fcgiwrap'
      - '/perl-fcgi'
      - '/plackup'
      - '/starman'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
  condition: selection_parent and selection_child
falsepositives:
  - RT scrips invoking external commands via configured actions
  - Legitimate mail delivery integrations under rt-mailgate
level: high
---
title: Outbound Connection from RT Web Application Process
id: 61c3f8a4-2b9d-4e7c-a5f1-8d4b6c2e9f37
status: experimental
description: Detects the RT Perl application or its web server worker initiating outbound network connections to non-standard destinations, a potential indicator of command-and-control or data staging following exploitation of flaws patched in rt 5.0.10.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-perl-encoding-fixlatin
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: linux
detection:
  selection_process:
    Image|endswith:
      - '/perl'
      - '/perl-fcgi'
      - '/plackup'
      - '/starman'
  filter_ports:
    DestinationPort:
      - 25
      - 143
      - 993
      - 3306
      - 5432
  condition: selection_process and not filter_ports
falsepositives:
  - RT outbound SMTP if delivered through an uncommon port
  - External REST integrations and webhooks configured in RT
level: medium

KQL (Microsoft Sentinel / Defender)

The first query hunts RT web attack patterns in ingested Apache/nginx logs via Syslog or CEF. The second audits package state across your Fedora fleet via collected command output or endpoint telemetry, proving whether the fix is deployed.

// Hunt: Suspicious request patterns against Request Tracker URI space
// Source: Apache/nginx access logs ingested via Syslog or CommonSecurityLog (CEF)
let rt_paths = dynamic(["/Ticket/", "/REST/", "/Search/", "/Ticket/Display.html", "/SelfService/"]);
let attack_markers = dynamic(["../", "..%2f", "%2e%2e", "<script", "%3Cscript", "{{", "union select", "UNION%20SELECT", "/etc/passwd", "file="]);
union isfuzzy=true
    (Syslog
     | where Facility =~ "local0" or ProcessName has_any ("httpd", "nginx", "apache")
     | extend RawMsg = SyslogMessage),
    (CommonSecurityLog
     | where DeviceProduct has_any ("apache", "nginx")
     | extend RawMsg = strcat(RequestURL, " ", RequestMethod, " ", coalesce(RequestContext, "")))
| where RawMsg has_any (rt_paths)
| where RawMsg has_any (attack_markers)
| summarize HitCount = count(), Samples = make_set(strcat(tostring(TimeGenerated), " | ", tostring(RawMsg)), 10)
    by Computer, coalesce(SourceIP, column_ifexists("SourceIP", "")), bin(TimeGenerated, 1h)
| order by HitCount desc;

// Audit: Identify Fedora hosts still running vulnerable rt package versions
// Assumes a CustomLog or Heartbeat-adjacent feed of 'rpm -q rt' output, or MDE Linux process/file data
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has "rpm" and ProcessCommandLine has "rt"
| project TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated desc;

Velociraptor VQL

Use this artifact for targeted forensic checks on RT servers — confirming package version, enumerating RT web process lineage, and reviewing recently modified webroot content for webshell drops following potential pre-patch exploitation.

-- Artifact: Linux.Hunt.RT.ExposureCheck
-- Purpose: Triage Request Tracker hosts for vulnerable versions and post-exploitation artifacts
-- related to the RT 5.0.10 multi-CVE patch cycle (CVE-2025-61873 et al.)

-- 1) Running RT/Perl web processes and their command lines
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(rt-server|plackup|starman|perl-fcgi|fcgid|rt-mailgate)'
   OR Exe =~ '(plackup|starman)'

-- 2) Recently modified files under common RT web/mason roots (webshell triage)
SELECT FullPath, Size, Mtime, Ctime, Mode
FROM glob(globs=['/opt/rt5/share/html/**/*', '/usr/share/rt5/html/**/*', '/var/www/rt*/**/*'])
WHERE Mtime > now() - 14*24*3600
  AND FullPath =~ '\.(pl|pm|cgi|php|jsp|sh)$'
ORDER BY Mtime DESC

-- 3) Outbound connections from Perl/web processes
SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, State
FROM netstat()
WHERE Name =~ '(perl|plackup|starman|httpd|nginx)'
  AND State =~ 'ESTABLISHED'
  AND NOT RemotePort in (25, 143, 993, 3306, 5432)

Remediation Script (Bash)

The following script patches RT on Fedora 43, verifies the installed version, restarts the web tier, and performs a quick exposure sanity check. Run it per host or wrap it in your configuration management (Ansible ad-hoc, Salt, etc.).

#!/usr/bin/env bash
# Remediate Fedora 43 Request Tracker multi-CVE advisory (rt 5.0.10)
# Addresses: CVE-2025-61873, CVE-2026-41075, CVE-2026-41076, CVE-2026-6841,
#            CVE-2026-44231, CVE-2026-44229, CVE-2026-44230
set -euo pipefail

REQUIRED_MAJOR_MINOR="5.0"
REQUIRED_PATCH=10

echo "[*] Current RT package state:"
rpm -q rt || { echo "[!] rt package not installed; nothing to do here."; exit 0; }

echo "[*] Applying Fedora updates for rt..."
dnf clean expire-cache -y
dnf upgrade -y rt

echo "[*] Verifying installed version..."
INSTALLED=$(rpm -q --queryformat '%{VERSION}' rt)
echo "[+] Installed rt version: ${INSTALLED}"
IFS='.' read -r MAJ MIN PAT <<< "${INSTALLED}"
if [[ "${MAJ}.${MIN}" == "${REQUIRED_MAJOR_MINOR}" ]] && (( PAT >= REQUIRED_PATCH )); then
  echo "[+] PASS: rt ${INSTALLED} meets the fixed baseline (>= 5.0.10)."
else
  echo "[-] FAIL: rt ${INSTALLED} is still below 5.0.10. Investigate repo mirrors/pinning."
  exit 1
fi

echo "[*] Restarting web tier to load patched code..."
if systemctl list-unit-files | grep -q '^httpd.service'; then
  systemctl restart httpd
elif systemctl list-unit-files | grep -q '^nginx.service'; then
  systemctl restart nginx
fi
systemctl is-active --quiet httpd && echo "[+] httpd running." || true
systemctl is-active --quiet nginx && echo "[+] nginx running." || true

echo "[*] Exposure check — listening sockets on web/mail ports:"
ss -tlnp | grep -E ':(80|443|25)\b' || echo "[!] No standard web/mail listeners found."

echo "[*] Review RT logs for anomalies during the pre-patch window:"
journalctl -u httpd --since "-14 days" --no-pager | grep -iE 'error|crit|alert' | tail -n 25 || true
grep -iE '(\.\./|%2e%2e|<script|union.select|/etc/passwd)' /var/log/httpd/*access*log* 2>/dev/null | tail -n 25 || true

echo "[+] Done. Confirm functional ticket creation/mailgate flow post-restart."

Remediation

1. Patch immediately. Update all Fedora 43 systems running RT to rt 5.0.10 via dnf upgrade rt, then restart the web tier (httpd/nginx) so the Perl application reloads patched code. A package update without a process restart leaves the vulnerable code resident in long-lived FastCGI/PSGI workers.
2. Inventory every RT instance. Enumerate VMs, containers, and forgotten service-desk boxes. RT is frequently deployed as a shadow-IT ticketing tool by individual teams — scan for HTTP fingerprints (RT/5.0 in headers, /Ticket/Display.html paths) across your IP space and certificate transparency logs for your domains.
3. Verify other distribution channels. If you run RT from Debian packages, EPEL, Docker images, or a source install from Best Practical, confirm each one against the upstream fixed release. The Fedora advisory only covers Fedora's package; your exposure is wherever RT < 5.0.10 runs.
4. Reduce external exposure while patching. If the instance does not strictly require anonymous public access, place it behind VPN or an authenticated reverse-proxy allowlist. rt-mailgate mail ingestion can continue even with the web UI restricted, since mail arrives over SMTP, not HTTP.
5. Restrict the REST interfaces. Audit whether /REST/1.0/ and /REST/2.0/ endpoints are required externally. Disable or ACL them at the reverse proxy if they are only used by internal integrations.
6. Hunt the pre-patch window. Because these CVEs are public and the patch diff is public, assume probing began around disclosure. Review 14+ days of access logs for the traversal, XSS, and injection markers in the detections above, and check RT's own logs (/opt/rt5/var/log/ or your configured log target) for anomalous ticket creation or authentication events.
7. Review RT privileges and scrips. Post-patch, audit RT users with SuperUser or elevated rights, review custom Scrips that invoke external commands (a common post-exploitation persistence location in RT), and rotate RT database credentials and any API tokens if you find evidence of compromise.
8. Track the CVE records. Monitor NVD entries for CVE-2025-61873, CVE-2026-41075, CVE-2026-41076, CVE-2026-6841, CVE-2026-44231, CVE-2026-44229, and CVE-2026-44230 as CVSS scores and CWE details populate, plus Best Practical's security advisory page, to refine risk ratings for your change-advisory board.
9. Feed scanners the new baseline. Update your vulnerability management platform's authenticated Linux checks to flag rt < 5.0.10, and add a compliance rule so future Fedora hosts can't drift back below the fixed version.

Official references: Fedora update advisory (via linuxsecurity.com advisory feed: https://linuxsecurity.com/advisories/fedora/fedora-perl-encoding-fixlatin), Best Practical security releases (https://bestpractical.com/), and NVD records for the seven CVE identifiers listed above.

No CISA KEV deadline currently applies to these CVEs, but internet-facing ticketing systems should be treated as a 72-hour patch SLA in any mature vulnerability management program.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub