Description
The S/MIME feature in Open Ticket Request System (OTRS) before 2.2.5, and 2.3.x before 2.3.0-beta1, does not properly configure the RANDFILE environment variable for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available for cryptographic operations, related to inability to write to the seeding file.
References (3)
Core 3
Core References
Various Sources x_refsource_confirm
http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807
Patch x_refsource_confirm
http://bugs.otrs.org/show_bug.cgi?id=2539
Patch x_refsource_confirm
http://bugs.otrs.org/show_bug.cgi?id=2844
Scores
EPSS
0.0198
EPSS Percentile
78.2%
Details
CWE
CWE-20
Status
published
Products (29)
otrs/otrs
0.5 beta1 (8 CPE variants)
otrs/otrs
1.0 rc1 (3 CPE variants)
otrs/otrs
1.0.0
otrs/otrs
1.0.1
otrs/otrs
1.0.2
otrs/otrs
1.1 rc1
otrs/otrs
1.1.0 rc1 (2 CPE variants)
otrs/otrs
1.1.1
otrs/otrs
1.1.2
otrs/otrs
1.1.3
... and 19 more
Published
Mar 18, 2011
Tracked Since
Feb 18, 2026