Vulnerability · Published May 5, 2025 · Assigned by INCIBE
CVE-2025-2545Deprecated 3DES cryptographic algorithm used by Request Tracker in emails encrypted with S/MIME
Low 2.3
In plain English
A low-severity broken cryptography in Request Tracker from Best Practical Solutions. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Vulnerability in Best Practical Solutions, LLC's Request Tracker prior to v5.0.8, where the Triple DES (3DES) cryptographic algorithm is used to protect emails sent with S/MIME encryption. Triple DES is considered obsolete and insecure due to its susceptibility to birthday attacks, which could compromise the confidentiality of encrypted messages.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | request-tracker4 | 4.4.6+dfsg-1.1+deb12u2 | DEBIAN-CVE-2025-2545 |
| Debian:12 | request-tracker4 | 4.4.6+dfsg-1.1+deb12u2 | DSA-5911-1 |
| Debian:12 | request-tracker5 | 5.0.3+dfsg-3~deb12u3 | DSA-5909-1 |
| Debian:12 | request-tracker5 | 5.0.3+dfsg-3~deb12u3 | DEBIAN-CVE-2025-2545 |
| Debian:13 | request-tracker5 | 5.0.7+dfsg-3 | DEBIAN-CVE-2025-2545 |
| Debian:14 | request-tracker5 | 5.0.7+dfsg-3 | DEBIAN-CVE-2025-2545 |
| Ubuntu:22.04:LTS | request-tracker4 | no fix listed | UBUNTU-CVE-2025-2545 |
| Ubuntu:24.04:LTS | request-tracker4 | no fix listed | UBUNTU-CVE-2025-2545 |
| Ubuntu:25.10 | request-tracker4 | no fix listed | UBUNTU-CVE-2025-2545 |
| Ubuntu:26.04:LTS | request-tracker4 | no fix listed | UBUNTU-CVE-2025-2545 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Best Practical Solutions | Request Tracker | 0 – before 5.0.8 |
Weakness: CWE-327 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N