<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="4">
<package pkgid="a0acee1f7a1a6dd2998fc0f85bd2b6d9503fb080d1ff25264910a106c2422c9e" name="otrs" arch="noarch">
  <version epoch="0" ver="5.0.42" rel="3.2.eol"/>
  <changelog author="chris@computersalat.de" date="1506168000">- fix for boo#1059691 (CVE-2017-14635)
  * Code Injection / Privilege Escalation OTRS
- Update to 4.0.25
  * Improved validation in statistic import and export.
    see OSA-2017-04 (Code Injection / Privilege Escalation OTRS)
  * for more info see https://www.otrs.com/release-notes-otrs-4-patch-level-25/</changelog>
  <changelog author="astieger@suse.com" date="1506254400">- fix and make universal itsm-update.sh
- replace itsm tarball so generated</changelog>
  <changelog author="chris@computersalat.de" date="1506772800">- improve itsm-update.sh to provide
  * current and previous itsm packages
  * exclude PreRelease packages (*x.y.9?.opm)
- replace itsm tarball so generated</changelog>
  <changelog author="chris@computersalat.de" date="1511352000">- fix for boo#1069391 (CVE-2017-16664, OSA-2017-07)
  * vulnerabilities discovered in the OTRS framework:
    An attacker who is logged into OTRS as an agent can request special
    URLs from OTRS which can lead to the execution of shell commands
    with the permissions of the web server user.
- Update to 4.0.26
  * Improved handling of spell checker.
  * https://github.com/OTRS/otrs/blob/rel-4_0_26/CHANGES.md
- improve itsm-update.sh
  * only package latest packages (&lt;10)
- rebase patches
  * otrs-httpd_conf.patch
  * otrs-perm_test.patch
- fix permissions (SLE 11)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="chris@computersalat.de" date="1512734400">- fix for boo#1071797 (CVE-2017-16921, OSA-2017-09)
  * Remote code execution:
    An attacker who is logged into OTRS as an agent can manipulate
    form parameters and execute arbitrary shell commands with the
    permissions of the OTRS or web server user.
- fix for boo#1071799 (CVE-2017-16854, OSA-2017-08)
  * Information Disclosure:
    An attacker who is logged into OTRS as a customer can use the
    ticket search form to disclose internal article information
    of their customer tickets.
- Update to 4.0.27
  * https://github.com/OTRS/otrs/blob/rel-4_0_27/CHANGES.md</changelog>
  <changelog author="chris@computersalat.de" date="1514462400">- fix for boo#1073747 (CVE-2017-17476, OSA-2017-10)
  * Session hijacking
    An attacker can send a specially prepared email to an OTRS system.
    If this system has cookie support disabled, and a logged in agent
    clicks a link in this email, the session information could be
    leaked to external systems, allowing the attacker to take over
    the agent?s session.
- Update to 4.0.28
  * https://github.com/OTRS/otrs/blob/rel-4_0_28/CHANGES.md
- improve itsm-update.sh</changelog>
  <changelog author="chris@computersalat.de" date="1514462401">- Update to 5.0.26
  * https://www.otrs.com/release-notes-otrs-5s-patch-level-26
  * https://www.otrs.com/release-notes-otrsitsm-module-5s-patch-level-26/
- remove obsolete
  * otrs-scheduler.service
  * otrs-scheduler.init</changelog>
  <changelog author="chris@computersalat.de" date="1516795200">- fix wrong fillup_only call</changelog>
  <changelog author="chris@computersalat.de" date="1531310400">- Update to 5.0.28
  * Renamed 'OTRS Free' to '((OTRS)) Community Edition'.
  * https://github.com/OTRS/otrs/blob/rel-5_0_28/CHANGES.md
- improve itsm-update.sh
- fix otrs.service
  * remove otrs-scheduler.service from [Unit]After</changelog>
  <changelog author="chris@computersalat.de" date="1537963200">- Update to 5.0.30
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-30/
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-29/
- fix for boo#1109822 (CVE-2018-16586, OSA-2018-05)
  * Loading External Image or CSS Resources
    An attacker could send a malicious email to an OTRS system. If a
    logged in user opens it, the email could cause the browser to
    load external image or CSS resources.
- fix for boo#1109823 (CVE-2018-16587, OSA-2018-04)
  * Remote File Deletion
    An attacker could send a malicious email to an OTRS system. If a user
    with admin permissions opens it, it causes deletions of arbitrary
    files that the OTRS web server user has write access to.
- fix for boo#1103800 (CVE-2018-14593, OSA-2018-03)
  * Privilege Escalation
    An attacker who is logged into OTRS as a user may escalate their
    privileges by accessing a specially crafted URL.
- improve itsm-update.sh
- fix permissions file
  * @OTRS_ROOT@/var/tmp -&gt; @OTRS_ROOT@/var/tmp/</changelog>
  <changelog author="chris@computersalat.de" date="1543492800">- Update to 5.0.32
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-32/
- fix for boo#1116004
  * (CVE-2018-20800, OSA-2018-10)
    Data loss during migration
    Users updating to OTRS 6.0.13 (also patchlevel updates) or 5.0.31
    (only major updates) will experience data loss in their agent
    preferences table.
- fix for boo#1115416
  * (CVE-2018-19141, OSA-2018-09)
    Privilege Escalation
    An attacker who is logged into OTRS as an admin user may manipulate
    the URL to cause execution of JavaScript in the context of OTRS.
  * (CVE-2018-19143, OSA-2018-07)
    Remote File Deletion
    An attacker who is logged into OTRS as a user may manipulate the
    submission form to cause deletion of arbitrary files that the
    OTRS web server user has write access to.</changelog>
  <changelog author="chris@computersalat.de" date="1547899200">- Update to 5.0.34
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-34/
- fix for boo#1122560
  * (CVE-2019-9752, OSA-2019-01)
    Stored XSS
    An attacker who is logged into OTRS as an agent or a customer user
    may upload a carefully crafted resource in order to cause execution
    of JavaScript in the context of OTRS.
- Update to 5.0.33
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-33/</changelog>
  <changelog author="chris@computersalat.de" date="1561204800">- update missing CVE for OSA-2018-10, OSA-2019-01</changelog>
  <changelog author="chris@computersalat.de" date="1561809600">- Update to 5.0.36
  https://community.otrs.com/release-notes-otrs-5s-patch-level-36/
- fix for boo#1137614
  * (CVE-2019-12497, OSA-2019-09)
    Information Disclosure
    In the customer or external frontend, personal information of agents
    can be disclosed like Name and mail address in external notes.
- fix for boo#1137615
  * (CVE-2019-12248, OSA-2019-08)
    Loading External Image Resources
    An attacker could send a malicious email to an OTRS system. If a
    logged in agent user quotes it, the email could cause the browser
    to load external image resources.
- Update to 5.0.35
  https://community.otrs.com/release-notes-otrs-5s-patch-level-35/
- fix for boo#1139406
  * (CVE-2019-10067, OSA-2019-05)
    Reflected and Stored XSS
    An attacker who is logged into OTRS as an agent user with appropriate
    permissions may manipulate the URL to cause execution of JavaScript
    in the context of OTRS.
- fix for boo#1139406
  * (CVE-2019-9892, OSA-2019-04)
    XXE Processing
    An attacker who is logged into OTRS as an agent user with appropriate
    permissions may try to import carefully crafted Report Statistics XML
    that will result in reading of arbitrary files of OTRS filesystem.
- rebase otrs-perm_test.patch</changelog>
  <changelog author="chris@computersalat.de" date="1563624000">- Update to 5.0.37
  https://community.otrs.com/release-notes-otrs-5s-patch-level-37/
- fix for boo#1141432
  * (CVE-2019-13458, OSA-2019-12)
    Information Disclosure
    An attacker who is logged into OTRS as an agent user with
    appropriate permissions can leverage OTRS tags in templates in
    order to disclose hashed user passwords.
- fix for boo#1141431
  * (CVE-2019-13457, OSA-2019-11)
    Information Disclosure
    A customer user can use the search results to disclose information
    from their ?company? tickets (with the same CustomerID), even when
    CustomerDisableCompanyTicketAccess setting is turned on.
- fix for boo#1141430
  * (CVE-2019-12746, OSA-2019-10)
    Session ID Disclosure
    A user logged into OTRS as an agent might unknowingly disclose
    their session ID by sharing the link of an embedded ticket article
    with third parties. This identifier can be then potentially abused
    in order to impersonate the agent user.</changelog>
  <changelog author="chris@computersalat.de" date="1573387200">- Update to 5.0.38
  https://community.otrs.com/release-notes-otrs-5s-patch-level-38/
- fix for boo#1156431
  * (CVE-2019-16375, OSA-2019-13)
    Stored XXS
    An attacker who is logged into OTRS as an agent or customer user
    with appropriate permissions can create a carefully crafted
    string containing malicious JavaScript code as an article body.
    This malicious code is executed when an agent compose an answer
    to the original article.</changelog>
  <changelog author="chris@computersalat.de" date="1577534400">- Update 5.0.39
  https://community.otrs.com/otrs-community-edition-5s-patch-level-39/
- fix for boo#1157001
  * (CVE-2019-18180, OSA-2019-15)
    Denial of service
    OTRS can be put into an endless loop by providing filenames with
    overly long extensions. This applies to the PostMaster
    (sending in email) and also upload
    (attaching files to mails, for example).
  * (CVE-2019-18179, OSA-2019-14)
    Information Disclosure
    An attacker who is logged into OTRS as an agent is able to list
    tickets assigned to other agents, which are in the queue where
    attacker doesn?t have permissions.</changelog>
  <changelog author="chris@computersalat.de" date="1578657600">- Update to 5.0.40
  https://community.otrs.com/otrs-community-edition-5s-patch-level-40/
- fix for boo#1160663
  * (CVE-2020-1766, OSA-2020-02)
    Improper handling of uploaded inline images
    Due to improper handling of uploaded images it is possible in very
    unlikely and rare conditions to force the agents browser to execute
    malicious javascript from a special crafted SVG file rendered as
    inline jpg file.
  * (CVE-2020-1765, OSA-2020-01)
    Spoofing of From field in several screens
    An improper control of parameters allows the spoofing of the from
    fields of the following screens:
    AgentTicketCompose, AgentTicketForward, AgentTicketBounce and
    AgentTicketEmailOutbound
  * run bin/otrs.Console.pl Maint::Config::Rebuild after the upgrade
- !!! This is latest update for 5.0.x Release by OTRS !!!</changelog>
  <changelog author="chris@computersalat.de" date="1586260800">- Update to 5.0.42
  https://community.otrs.com/otrs-community-edition-5s-patch-level-42/
- fix for boo#1168029 (CVE-2020-1773, OSA-2020-10)
  * Session / Password / Password token leak
    An attacker with the ability to generate session IDs or password
    reset tokens, either by being able to authenticate or by exploiting
    OSA-2020-09, may be able to predict other users session IDs,
    password reset tokens and automatically generated passwords.
- fix for boo#1168029 (CVE-2020-1772, OSA-2020-09)
  * Information Disclosure
    It?s possible to craft Lost Password requests with wildcards in
    the Token value, which allows attacker to retrieve valid Token(s),
    generated by users which already requested new passwords.
- fix for boo#1168030 (CVE-2020-1771, OSA-2020-08)
  * Possible XSS in Customer user address book
    Attacker is able craft an article with a link to the customer
    address book with malicious content (JavaScript). When agent opens
    the link, JavaScript code is executed due to the missing parameter
    encoding.
- fix for boo#1168031 (CVE-2020-1770, OSA-2020-07)
  * Information disclosure in support bundle files
    Support bundle generated files could contain sensitive information
    that might be unwanted to be disclosed.
- fix for boo#1168032 (CVE-2020-1769, OSA-2020-06)
  * Autocomplete in the form login screens
    In the login screens (in agent and customer interface), Username
    and Password fields use autocomplete, which might be considered
    as security issue.
- Update to 5.0.41
  https://community.otrs.com/otrs-community-edition-5s-patch-level-41/
  * bug#14912 - Installer refers to non-existing documentation
- add code to upgrade OTRS from 4 to 5
  READ UPGRADING.SUSE
  * steps 1 to 4 are done by rpm pkg
  * steps 5 to *END* need to be done manully cause of DB backup
- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
</package>
<package pkgid="cf59332e2563d538626d4277644dc927cf1cecbb3e400ce47d63631a6419e51c" name="otrs" arch="src">
  <version epoch="0" ver="5.0.42" rel="3.2.eol"/>
  <changelog author="chris@computersalat.de" date="1506168000">- fix for boo#1059691 (CVE-2017-14635)
  * Code Injection / Privilege Escalation OTRS
- Update to 4.0.25
  * Improved validation in statistic import and export.
    see OSA-2017-04 (Code Injection / Privilege Escalation OTRS)
  * for more info see https://www.otrs.com/release-notes-otrs-4-patch-level-25/</changelog>
  <changelog author="astieger@suse.com" date="1506254400">- fix and make universal itsm-update.sh
- replace itsm tarball so generated</changelog>
  <changelog author="chris@computersalat.de" date="1506772800">- improve itsm-update.sh to provide
  * current and previous itsm packages
  * exclude PreRelease packages (*x.y.9?.opm)
- replace itsm tarball so generated</changelog>
  <changelog author="chris@computersalat.de" date="1511352000">- fix for boo#1069391 (CVE-2017-16664, OSA-2017-07)
  * vulnerabilities discovered in the OTRS framework:
    An attacker who is logged into OTRS as an agent can request special
    URLs from OTRS which can lead to the execution of shell commands
    with the permissions of the web server user.
- Update to 4.0.26
  * Improved handling of spell checker.
  * https://github.com/OTRS/otrs/blob/rel-4_0_26/CHANGES.md
- improve itsm-update.sh
  * only package latest packages (&lt;10)
- rebase patches
  * otrs-httpd_conf.patch
  * otrs-perm_test.patch
- fix permissions (SLE 11)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="chris@computersalat.de" date="1512734400">- fix for boo#1071797 (CVE-2017-16921, OSA-2017-09)
  * Remote code execution:
    An attacker who is logged into OTRS as an agent can manipulate
    form parameters and execute arbitrary shell commands with the
    permissions of the OTRS or web server user.
- fix for boo#1071799 (CVE-2017-16854, OSA-2017-08)
  * Information Disclosure:
    An attacker who is logged into OTRS as a customer can use the
    ticket search form to disclose internal article information
    of their customer tickets.
- Update to 4.0.27
  * https://github.com/OTRS/otrs/blob/rel-4_0_27/CHANGES.md</changelog>
  <changelog author="chris@computersalat.de" date="1514462400">- fix for boo#1073747 (CVE-2017-17476, OSA-2017-10)
  * Session hijacking
    An attacker can send a specially prepared email to an OTRS system.
    If this system has cookie support disabled, and a logged in agent
    clicks a link in this email, the session information could be
    leaked to external systems, allowing the attacker to take over
    the agent?s session.
- Update to 4.0.28
  * https://github.com/OTRS/otrs/blob/rel-4_0_28/CHANGES.md
- improve itsm-update.sh</changelog>
  <changelog author="chris@computersalat.de" date="1514462401">- Update to 5.0.26
  * https://www.otrs.com/release-notes-otrs-5s-patch-level-26
  * https://www.otrs.com/release-notes-otrsitsm-module-5s-patch-level-26/
- remove obsolete
  * otrs-scheduler.service
  * otrs-scheduler.init</changelog>
  <changelog author="chris@computersalat.de" date="1516795200">- fix wrong fillup_only call</changelog>
  <changelog author="chris@computersalat.de" date="1531310400">- Update to 5.0.28
  * Renamed 'OTRS Free' to '((OTRS)) Community Edition'.
  * https://github.com/OTRS/otrs/blob/rel-5_0_28/CHANGES.md
- improve itsm-update.sh
- fix otrs.service
  * remove otrs-scheduler.service from [Unit]After</changelog>
  <changelog author="chris@computersalat.de" date="1537963200">- Update to 5.0.30
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-30/
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-29/
- fix for boo#1109822 (CVE-2018-16586, OSA-2018-05)
  * Loading External Image or CSS Resources
    An attacker could send a malicious email to an OTRS system. If a
    logged in user opens it, the email could cause the browser to
    load external image or CSS resources.
- fix for boo#1109823 (CVE-2018-16587, OSA-2018-04)
  * Remote File Deletion
    An attacker could send a malicious email to an OTRS system. If a user
    with admin permissions opens it, it causes deletions of arbitrary
    files that the OTRS web server user has write access to.
- fix for boo#1103800 (CVE-2018-14593, OSA-2018-03)
  * Privilege Escalation
    An attacker who is logged into OTRS as a user may escalate their
    privileges by accessing a specially crafted URL.
- improve itsm-update.sh
- fix permissions file
  * @OTRS_ROOT@/var/tmp -&gt; @OTRS_ROOT@/var/tmp/</changelog>
  <changelog author="chris@computersalat.de" date="1543492800">- Update to 5.0.32
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-32/
- fix for boo#1116004
  * (CVE-2018-20800, OSA-2018-10)
    Data loss during migration
    Users updating to OTRS 6.0.13 (also patchlevel updates) or 5.0.31
    (only major updates) will experience data loss in their agent
    preferences table.
- fix for boo#1115416
  * (CVE-2018-19141, OSA-2018-09)
    Privilege Escalation
    An attacker who is logged into OTRS as an admin user may manipulate
    the URL to cause execution of JavaScript in the context of OTRS.
  * (CVE-2018-19143, OSA-2018-07)
    Remote File Deletion
    An attacker who is logged into OTRS as a user may manipulate the
    submission form to cause deletion of arbitrary files that the
    OTRS web server user has write access to.</changelog>
  <changelog author="chris@computersalat.de" date="1547899200">- Update to 5.0.34
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-34/
- fix for boo#1122560
  * (CVE-2019-9752, OSA-2019-01)
    Stored XSS
    An attacker who is logged into OTRS as an agent or a customer user
    may upload a carefully crafted resource in order to cause execution
    of JavaScript in the context of OTRS.
- Update to 5.0.33
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-33/</changelog>
  <changelog author="chris@computersalat.de" date="1561204800">- update missing CVE for OSA-2018-10, OSA-2019-01</changelog>
  <changelog author="chris@computersalat.de" date="1561809600">- Update to 5.0.36
  https://community.otrs.com/release-notes-otrs-5s-patch-level-36/
- fix for boo#1137614
  * (CVE-2019-12497, OSA-2019-09)
    Information Disclosure
    In the customer or external frontend, personal information of agents
    can be disclosed like Name and mail address in external notes.
- fix for boo#1137615
  * (CVE-2019-12248, OSA-2019-08)
    Loading External Image Resources
    An attacker could send a malicious email to an OTRS system. If a
    logged in agent user quotes it, the email could cause the browser
    to load external image resources.
- Update to 5.0.35
  https://community.otrs.com/release-notes-otrs-5s-patch-level-35/
- fix for boo#1139406
  * (CVE-2019-10067, OSA-2019-05)
    Reflected and Stored XSS
    An attacker who is logged into OTRS as an agent user with appropriate
    permissions may manipulate the URL to cause execution of JavaScript
    in the context of OTRS.
- fix for boo#1139406
  * (CVE-2019-9892, OSA-2019-04)
    XXE Processing
    An attacker who is logged into OTRS as an agent user with appropriate
    permissions may try to import carefully crafted Report Statistics XML
    that will result in reading of arbitrary files of OTRS filesystem.
- rebase otrs-perm_test.patch</changelog>
  <changelog author="chris@computersalat.de" date="1563624000">- Update to 5.0.37
  https://community.otrs.com/release-notes-otrs-5s-patch-level-37/
- fix for boo#1141432
  * (CVE-2019-13458, OSA-2019-12)
    Information Disclosure
    An attacker who is logged into OTRS as an agent user with
    appropriate permissions can leverage OTRS tags in templates in
    order to disclose hashed user passwords.
- fix for boo#1141431
  * (CVE-2019-13457, OSA-2019-11)
    Information Disclosure
    A customer user can use the search results to disclose information
    from their ?company? tickets (with the same CustomerID), even when
    CustomerDisableCompanyTicketAccess setting is turned on.
- fix for boo#1141430
  * (CVE-2019-12746, OSA-2019-10)
    Session ID Disclosure
    A user logged into OTRS as an agent might unknowingly disclose
    their session ID by sharing the link of an embedded ticket article
    with third parties. This identifier can be then potentially abused
    in order to impersonate the agent user.</changelog>
  <changelog author="chris@computersalat.de" date="1573387200">- Update to 5.0.38
  https://community.otrs.com/release-notes-otrs-5s-patch-level-38/
- fix for boo#1156431
  * (CVE-2019-16375, OSA-2019-13)
    Stored XXS
    An attacker who is logged into OTRS as an agent or customer user
    with appropriate permissions can create a carefully crafted
    string containing malicious JavaScript code as an article body.
    This malicious code is executed when an agent compose an answer
    to the original article.</changelog>
  <changelog author="chris@computersalat.de" date="1577534400">- Update 5.0.39
  https://community.otrs.com/otrs-community-edition-5s-patch-level-39/
- fix for boo#1157001
  * (CVE-2019-18180, OSA-2019-15)
    Denial of service
    OTRS can be put into an endless loop by providing filenames with
    overly long extensions. This applies to the PostMaster
    (sending in email) and also upload
    (attaching files to mails, for example).
  * (CVE-2019-18179, OSA-2019-14)
    Information Disclosure
    An attacker who is logged into OTRS as an agent is able to list
    tickets assigned to other agents, which are in the queue where
    attacker doesn?t have permissions.</changelog>
  <changelog author="chris@computersalat.de" date="1578657600">- Update to 5.0.40
  https://community.otrs.com/otrs-community-edition-5s-patch-level-40/
- fix for boo#1160663
  * (CVE-2020-1766, OSA-2020-02)
    Improper handling of uploaded inline images
    Due to improper handling of uploaded images it is possible in very
    unlikely and rare conditions to force the agents browser to execute
    malicious javascript from a special crafted SVG file rendered as
    inline jpg file.
  * (CVE-2020-1765, OSA-2020-01)
    Spoofing of From field in several screens
    An improper control of parameters allows the spoofing of the from
    fields of the following screens:
    AgentTicketCompose, AgentTicketForward, AgentTicketBounce and
    AgentTicketEmailOutbound
  * run bin/otrs.Console.pl Maint::Config::Rebuild after the upgrade
- !!! This is latest update for 5.0.x Release by OTRS !!!</changelog>
  <changelog author="chris@computersalat.de" date="1586260800">- Update to 5.0.42
  https://community.otrs.com/otrs-community-edition-5s-patch-level-42/
- fix for boo#1168029 (CVE-2020-1773, OSA-2020-10)
  * Session / Password / Password token leak
    An attacker with the ability to generate session IDs or password
    reset tokens, either by being able to authenticate or by exploiting
    OSA-2020-09, may be able to predict other users session IDs,
    password reset tokens and automatically generated passwords.
- fix for boo#1168029 (CVE-2020-1772, OSA-2020-09)
  * Information Disclosure
    It?s possible to craft Lost Password requests with wildcards in
    the Token value, which allows attacker to retrieve valid Token(s),
    generated by users which already requested new passwords.
- fix for boo#1168030 (CVE-2020-1771, OSA-2020-08)
  * Possible XSS in Customer user address book
    Attacker is able craft an article with a link to the customer
    address book with malicious content (JavaScript). When agent opens
    the link, JavaScript code is executed due to the missing parameter
    encoding.
- fix for boo#1168031 (CVE-2020-1770, OSA-2020-07)
  * Information disclosure in support bundle files
    Support bundle generated files could contain sensitive information
    that might be unwanted to be disclosed.
- fix for boo#1168032 (CVE-2020-1769, OSA-2020-06)
  * Autocomplete in the form login screens
    In the login screens (in agent and customer interface), Username
    and Password fields use autocomplete, which might be considered
    as security issue.
- Update to 5.0.41
  https://community.otrs.com/otrs-community-edition-5s-patch-level-41/
  * bug#14912 - Installer refers to non-existing documentation
- add code to upgrade OTRS from 4 to 5
  READ UPGRADING.SUSE
  * steps 1 to 4 are done by rpm pkg
  * steps 5 to *END* need to be done manully cause of DB backup
- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
</package>
<package pkgid="0470b9c9cb9c42160a147edbb9b68f3a6bdfa5c522a2480b5b396313b33e395b" name="otrs-doc" arch="noarch">
  <version epoch="0" ver="5.0.42" rel="3.2.eol"/>
  <changelog author="chris@computersalat.de" date="1506168000">- fix for boo#1059691 (CVE-2017-14635)
  * Code Injection / Privilege Escalation OTRS
- Update to 4.0.25
  * Improved validation in statistic import and export.
    see OSA-2017-04 (Code Injection / Privilege Escalation OTRS)
  * for more info see https://www.otrs.com/release-notes-otrs-4-patch-level-25/</changelog>
  <changelog author="astieger@suse.com" date="1506254400">- fix and make universal itsm-update.sh
- replace itsm tarball so generated</changelog>
  <changelog author="chris@computersalat.de" date="1506772800">- improve itsm-update.sh to provide
  * current and previous itsm packages
  * exclude PreRelease packages (*x.y.9?.opm)
- replace itsm tarball so generated</changelog>
  <changelog author="chris@computersalat.de" date="1511352000">- fix for boo#1069391 (CVE-2017-16664, OSA-2017-07)
  * vulnerabilities discovered in the OTRS framework:
    An attacker who is logged into OTRS as an agent can request special
    URLs from OTRS which can lead to the execution of shell commands
    with the permissions of the web server user.
- Update to 4.0.26
  * Improved handling of spell checker.
  * https://github.com/OTRS/otrs/blob/rel-4_0_26/CHANGES.md
- improve itsm-update.sh
  * only package latest packages (&lt;10)
- rebase patches
  * otrs-httpd_conf.patch
  * otrs-perm_test.patch
- fix permissions (SLE 11)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="chris@computersalat.de" date="1512734400">- fix for boo#1071797 (CVE-2017-16921, OSA-2017-09)
  * Remote code execution:
    An attacker who is logged into OTRS as an agent can manipulate
    form parameters and execute arbitrary shell commands with the
    permissions of the OTRS or web server user.
- fix for boo#1071799 (CVE-2017-16854, OSA-2017-08)
  * Information Disclosure:
    An attacker who is logged into OTRS as a customer can use the
    ticket search form to disclose internal article information
    of their customer tickets.
- Update to 4.0.27
  * https://github.com/OTRS/otrs/blob/rel-4_0_27/CHANGES.md</changelog>
  <changelog author="chris@computersalat.de" date="1514462400">- fix for boo#1073747 (CVE-2017-17476, OSA-2017-10)
  * Session hijacking
    An attacker can send a specially prepared email to an OTRS system.
    If this system has cookie support disabled, and a logged in agent
    clicks a link in this email, the session information could be
    leaked to external systems, allowing the attacker to take over
    the agent?s session.
- Update to 4.0.28
  * https://github.com/OTRS/otrs/blob/rel-4_0_28/CHANGES.md
- improve itsm-update.sh</changelog>
  <changelog author="chris@computersalat.de" date="1514462401">- Update to 5.0.26
  * https://www.otrs.com/release-notes-otrs-5s-patch-level-26
  * https://www.otrs.com/release-notes-otrsitsm-module-5s-patch-level-26/
- remove obsolete
  * otrs-scheduler.service
  * otrs-scheduler.init</changelog>
  <changelog author="chris@computersalat.de" date="1516795200">- fix wrong fillup_only call</changelog>
  <changelog author="chris@computersalat.de" date="1531310400">- Update to 5.0.28
  * Renamed 'OTRS Free' to '((OTRS)) Community Edition'.
  * https://github.com/OTRS/otrs/blob/rel-5_0_28/CHANGES.md
- improve itsm-update.sh
- fix otrs.service
  * remove otrs-scheduler.service from [Unit]After</changelog>
  <changelog author="chris@computersalat.de" date="1537963200">- Update to 5.0.30
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-30/
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-29/
- fix for boo#1109822 (CVE-2018-16586, OSA-2018-05)
  * Loading External Image or CSS Resources
    An attacker could send a malicious email to an OTRS system. If a
    logged in user opens it, the email could cause the browser to
    load external image or CSS resources.
- fix for boo#1109823 (CVE-2018-16587, OSA-2018-04)
  * Remote File Deletion
    An attacker could send a malicious email to an OTRS system. If a user
    with admin permissions opens it, it causes deletions of arbitrary
    files that the OTRS web server user has write access to.
- fix for boo#1103800 (CVE-2018-14593, OSA-2018-03)
  * Privilege Escalation
    An attacker who is logged into OTRS as a user may escalate their
    privileges by accessing a specially crafted URL.
- improve itsm-update.sh
- fix permissions file
  * @OTRS_ROOT@/var/tmp -&gt; @OTRS_ROOT@/var/tmp/</changelog>
  <changelog author="chris@computersalat.de" date="1543492800">- Update to 5.0.32
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-32/
- fix for boo#1116004
  * (CVE-2018-20800, OSA-2018-10)
    Data loss during migration
    Users updating to OTRS 6.0.13 (also patchlevel updates) or 5.0.31
    (only major updates) will experience data loss in their agent
    preferences table.
- fix for boo#1115416
  * (CVE-2018-19141, OSA-2018-09)
    Privilege Escalation
    An attacker who is logged into OTRS as an admin user may manipulate
    the URL to cause execution of JavaScript in the context of OTRS.
  * (CVE-2018-19143, OSA-2018-07)
    Remote File Deletion
    An attacker who is logged into OTRS as a user may manipulate the
    submission form to cause deletion of arbitrary files that the
    OTRS web server user has write access to.</changelog>
  <changelog author="chris@computersalat.de" date="1547899200">- Update to 5.0.34
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-34/
- fix for boo#1122560
  * (CVE-2019-9752, OSA-2019-01)
    Stored XSS
    An attacker who is logged into OTRS as an agent or a customer user
    may upload a carefully crafted resource in order to cause execution
    of JavaScript in the context of OTRS.
- Update to 5.0.33
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-33/</changelog>
  <changelog author="chris@computersalat.de" date="1561204800">- update missing CVE for OSA-2018-10, OSA-2019-01</changelog>
  <changelog author="chris@computersalat.de" date="1561809600">- Update to 5.0.36
  https://community.otrs.com/release-notes-otrs-5s-patch-level-36/
- fix for boo#1137614
  * (CVE-2019-12497, OSA-2019-09)
    Information Disclosure
    In the customer or external frontend, personal information of agents
    can be disclosed like Name and mail address in external notes.
- fix for boo#1137615
  * (CVE-2019-12248, OSA-2019-08)
    Loading External Image Resources
    An attacker could send a malicious email to an OTRS system. If a
    logged in agent user quotes it, the email could cause the browser
    to load external image resources.
- Update to 5.0.35
  https://community.otrs.com/release-notes-otrs-5s-patch-level-35/
- fix for boo#1139406
  * (CVE-2019-10067, OSA-2019-05)
    Reflected and Stored XSS
    An attacker who is logged into OTRS as an agent user with appropriate
    permissions may manipulate the URL to cause execution of JavaScript
    in the context of OTRS.
- fix for boo#1139406
  * (CVE-2019-9892, OSA-2019-04)
    XXE Processing
    An attacker who is logged into OTRS as an agent user with appropriate
    permissions may try to import carefully crafted Report Statistics XML
    that will result in reading of arbitrary files of OTRS filesystem.
- rebase otrs-perm_test.patch</changelog>
  <changelog author="chris@computersalat.de" date="1563624000">- Update to 5.0.37
  https://community.otrs.com/release-notes-otrs-5s-patch-level-37/
- fix for boo#1141432
  * (CVE-2019-13458, OSA-2019-12)
    Information Disclosure
    An attacker who is logged into OTRS as an agent user with
    appropriate permissions can leverage OTRS tags in templates in
    order to disclose hashed user passwords.
- fix for boo#1141431
  * (CVE-2019-13457, OSA-2019-11)
    Information Disclosure
    A customer user can use the search results to disclose information
    from their ?company? tickets (with the same CustomerID), even when
    CustomerDisableCompanyTicketAccess setting is turned on.
- fix for boo#1141430
  * (CVE-2019-12746, OSA-2019-10)
    Session ID Disclosure
    A user logged into OTRS as an agent might unknowingly disclose
    their session ID by sharing the link of an embedded ticket article
    with third parties. This identifier can be then potentially abused
    in order to impersonate the agent user.</changelog>
  <changelog author="chris@computersalat.de" date="1573387200">- Update to 5.0.38
  https://community.otrs.com/release-notes-otrs-5s-patch-level-38/
- fix for boo#1156431
  * (CVE-2019-16375, OSA-2019-13)
    Stored XXS
    An attacker who is logged into OTRS as an agent or customer user
    with appropriate permissions can create a carefully crafted
    string containing malicious JavaScript code as an article body.
    This malicious code is executed when an agent compose an answer
    to the original article.</changelog>
  <changelog author="chris@computersalat.de" date="1577534400">- Update 5.0.39
  https://community.otrs.com/otrs-community-edition-5s-patch-level-39/
- fix for boo#1157001
  * (CVE-2019-18180, OSA-2019-15)
    Denial of service
    OTRS can be put into an endless loop by providing filenames with
    overly long extensions. This applies to the PostMaster
    (sending in email) and also upload
    (attaching files to mails, for example).
  * (CVE-2019-18179, OSA-2019-14)
    Information Disclosure
    An attacker who is logged into OTRS as an agent is able to list
    tickets assigned to other agents, which are in the queue where
    attacker doesn?t have permissions.</changelog>
  <changelog author="chris@computersalat.de" date="1578657600">- Update to 5.0.40
  https://community.otrs.com/otrs-community-edition-5s-patch-level-40/
- fix for boo#1160663
  * (CVE-2020-1766, OSA-2020-02)
    Improper handling of uploaded inline images
    Due to improper handling of uploaded images it is possible in very
    unlikely and rare conditions to force the agents browser to execute
    malicious javascript from a special crafted SVG file rendered as
    inline jpg file.
  * (CVE-2020-1765, OSA-2020-01)
    Spoofing of From field in several screens
    An improper control of parameters allows the spoofing of the from
    fields of the following screens:
    AgentTicketCompose, AgentTicketForward, AgentTicketBounce and
    AgentTicketEmailOutbound
  * run bin/otrs.Console.pl Maint::Config::Rebuild after the upgrade
- !!! This is latest update for 5.0.x Release by OTRS !!!</changelog>
  <changelog author="chris@computersalat.de" date="1586260800">- Update to 5.0.42
  https://community.otrs.com/otrs-community-edition-5s-patch-level-42/
- fix for boo#1168029 (CVE-2020-1773, OSA-2020-10)
  * Session / Password / Password token leak
    An attacker with the ability to generate session IDs or password
    reset tokens, either by being able to authenticate or by exploiting
    OSA-2020-09, may be able to predict other users session IDs,
    password reset tokens and automatically generated passwords.
- fix for boo#1168029 (CVE-2020-1772, OSA-2020-09)
  * Information Disclosure
    It?s possible to craft Lost Password requests with wildcards in
    the Token value, which allows attacker to retrieve valid Token(s),
    generated by users which already requested new passwords.
- fix for boo#1168030 (CVE-2020-1771, OSA-2020-08)
  * Possible XSS in Customer user address book
    Attacker is able craft an article with a link to the customer
    address book with malicious content (JavaScript). When agent opens
    the link, JavaScript code is executed due to the missing parameter
    encoding.
- fix for boo#1168031 (CVE-2020-1770, OSA-2020-07)
  * Information disclosure in support bundle files
    Support bundle generated files could contain sensitive information
    that might be unwanted to be disclosed.
- fix for boo#1168032 (CVE-2020-1769, OSA-2020-06)
  * Autocomplete in the form login screens
    In the login screens (in agent and customer interface), Username
    and Password fields use autocomplete, which might be considered
    as security issue.
- Update to 5.0.41
  https://community.otrs.com/otrs-community-edition-5s-patch-level-41/
  * bug#14912 - Installer refers to non-existing documentation
- add code to upgrade OTRS from 4 to 5
  READ UPGRADING.SUSE
  * steps 1 to 4 are done by rpm pkg
  * steps 5 to *END* need to be done manully cause of DB backup
- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
</package>
<package pkgid="b79b751dcac58063ef46da005caf287d329349392d6aea1731f1c4d27a39318f" name="otrs-itsm" arch="noarch">
  <version epoch="0" ver="5.0.42" rel="3.2.eol"/>
  <changelog author="chris@computersalat.de" date="1506168000">- fix for boo#1059691 (CVE-2017-14635)
  * Code Injection / Privilege Escalation OTRS
- Update to 4.0.25
  * Improved validation in statistic import and export.
    see OSA-2017-04 (Code Injection / Privilege Escalation OTRS)
  * for more info see https://www.otrs.com/release-notes-otrs-4-patch-level-25/</changelog>
  <changelog author="astieger@suse.com" date="1506254400">- fix and make universal itsm-update.sh
- replace itsm tarball so generated</changelog>
  <changelog author="chris@computersalat.de" date="1506772800">- improve itsm-update.sh to provide
  * current and previous itsm packages
  * exclude PreRelease packages (*x.y.9?.opm)
- replace itsm tarball so generated</changelog>
  <changelog author="chris@computersalat.de" date="1511352000">- fix for boo#1069391 (CVE-2017-16664, OSA-2017-07)
  * vulnerabilities discovered in the OTRS framework:
    An attacker who is logged into OTRS as an agent can request special
    URLs from OTRS which can lead to the execution of shell commands
    with the permissions of the web server user.
- Update to 4.0.26
  * Improved handling of spell checker.
  * https://github.com/OTRS/otrs/blob/rel-4_0_26/CHANGES.md
- improve itsm-update.sh
  * only package latest packages (&lt;10)
- rebase patches
  * otrs-httpd_conf.patch
  * otrs-perm_test.patch
- fix permissions (SLE 11)</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="chris@computersalat.de" date="1512734400">- fix for boo#1071797 (CVE-2017-16921, OSA-2017-09)
  * Remote code execution:
    An attacker who is logged into OTRS as an agent can manipulate
    form parameters and execute arbitrary shell commands with the
    permissions of the OTRS or web server user.
- fix for boo#1071799 (CVE-2017-16854, OSA-2017-08)
  * Information Disclosure:
    An attacker who is logged into OTRS as a customer can use the
    ticket search form to disclose internal article information
    of their customer tickets.
- Update to 4.0.27
  * https://github.com/OTRS/otrs/blob/rel-4_0_27/CHANGES.md</changelog>
  <changelog author="chris@computersalat.de" date="1514462400">- fix for boo#1073747 (CVE-2017-17476, OSA-2017-10)
  * Session hijacking
    An attacker can send a specially prepared email to an OTRS system.
    If this system has cookie support disabled, and a logged in agent
    clicks a link in this email, the session information could be
    leaked to external systems, allowing the attacker to take over
    the agent?s session.
- Update to 4.0.28
  * https://github.com/OTRS/otrs/blob/rel-4_0_28/CHANGES.md
- improve itsm-update.sh</changelog>
  <changelog author="chris@computersalat.de" date="1514462401">- Update to 5.0.26
  * https://www.otrs.com/release-notes-otrs-5s-patch-level-26
  * https://www.otrs.com/release-notes-otrsitsm-module-5s-patch-level-26/
- remove obsolete
  * otrs-scheduler.service
  * otrs-scheduler.init</changelog>
  <changelog author="chris@computersalat.de" date="1516795200">- fix wrong fillup_only call</changelog>
  <changelog author="chris@computersalat.de" date="1531310400">- Update to 5.0.28
  * Renamed 'OTRS Free' to '((OTRS)) Community Edition'.
  * https://github.com/OTRS/otrs/blob/rel-5_0_28/CHANGES.md
- improve itsm-update.sh
- fix otrs.service
  * remove otrs-scheduler.service from [Unit]After</changelog>
  <changelog author="chris@computersalat.de" date="1537963200">- Update to 5.0.30
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-30/
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-29/
- fix for boo#1109822 (CVE-2018-16586, OSA-2018-05)
  * Loading External Image or CSS Resources
    An attacker could send a malicious email to an OTRS system. If a
    logged in user opens it, the email could cause the browser to
    load external image or CSS resources.
- fix for boo#1109823 (CVE-2018-16587, OSA-2018-04)
  * Remote File Deletion
    An attacker could send a malicious email to an OTRS system. If a user
    with admin permissions opens it, it causes deletions of arbitrary
    files that the OTRS web server user has write access to.
- fix for boo#1103800 (CVE-2018-14593, OSA-2018-03)
  * Privilege Escalation
    An attacker who is logged into OTRS as a user may escalate their
    privileges by accessing a specially crafted URL.
- improve itsm-update.sh
- fix permissions file
  * @OTRS_ROOT@/var/tmp -&gt; @OTRS_ROOT@/var/tmp/</changelog>
  <changelog author="chris@computersalat.de" date="1543492800">- Update to 5.0.32
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-32/
- fix for boo#1116004
  * (CVE-2018-20800, OSA-2018-10)
    Data loss during migration
    Users updating to OTRS 6.0.13 (also patchlevel updates) or 5.0.31
    (only major updates) will experience data loss in their agent
    preferences table.
- fix for boo#1115416
  * (CVE-2018-19141, OSA-2018-09)
    Privilege Escalation
    An attacker who is logged into OTRS as an admin user may manipulate
    the URL to cause execution of JavaScript in the context of OTRS.
  * (CVE-2018-19143, OSA-2018-07)
    Remote File Deletion
    An attacker who is logged into OTRS as a user may manipulate the
    submission form to cause deletion of arbitrary files that the
    OTRS web server user has write access to.</changelog>
  <changelog author="chris@computersalat.de" date="1547899200">- Update to 5.0.34
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-34/
- fix for boo#1122560
  * (CVE-2019-9752, OSA-2019-01)
    Stored XSS
    An attacker who is logged into OTRS as an agent or a customer user
    may upload a carefully crafted resource in order to cause execution
    of JavaScript in the context of OTRS.
- Update to 5.0.33
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-33/</changelog>
  <changelog author="chris@computersalat.de" date="1561204800">- update missing CVE for OSA-2018-10, OSA-2019-01</changelog>
  <changelog author="chris@computersalat.de" date="1561809600">- Update to 5.0.36
  https://community.otrs.com/release-notes-otrs-5s-patch-level-36/
- fix for boo#1137614
  * (CVE-2019-12497, OSA-2019-09)
    Information Disclosure
    In the customer or external frontend, personal information of agents
    can be disclosed like Name and mail address in external notes.
- fix for boo#1137615
  * (CVE-2019-12248, OSA-2019-08)
    Loading External Image Resources
    An attacker could send a malicious email to an OTRS system. If a
    logged in agent user quotes it, the email could cause the browser
    to load external image resources.
- Update to 5.0.35
  https://community.otrs.com/release-notes-otrs-5s-patch-level-35/
- fix for boo#1139406
  * (CVE-2019-10067, OSA-2019-05)
    Reflected and Stored XSS
    An attacker who is logged into OTRS as an agent user with appropriate
    permissions may manipulate the URL to cause execution of JavaScript
    in the context of OTRS.
- fix for boo#1139406
  * (CVE-2019-9892, OSA-2019-04)
    XXE Processing
    An attacker who is logged into OTRS as an agent user with appropriate
    permissions may try to import carefully crafted Report Statistics XML
    that will result in reading of arbitrary files of OTRS filesystem.
- rebase otrs-perm_test.patch</changelog>
  <changelog author="chris@computersalat.de" date="1563624000">- Update to 5.0.37
  https://community.otrs.com/release-notes-otrs-5s-patch-level-37/
- fix for boo#1141432
  * (CVE-2019-13458, OSA-2019-12)
    Information Disclosure
    An attacker who is logged into OTRS as an agent user with
    appropriate permissions can leverage OTRS tags in templates in
    order to disclose hashed user passwords.
- fix for boo#1141431
  * (CVE-2019-13457, OSA-2019-11)
    Information Disclosure
    A customer user can use the search results to disclose information
    from their ?company? tickets (with the same CustomerID), even when
    CustomerDisableCompanyTicketAccess setting is turned on.
- fix for boo#1141430
  * (CVE-2019-12746, OSA-2019-10)
    Session ID Disclosure
    A user logged into OTRS as an agent might unknowingly disclose
    their session ID by sharing the link of an embedded ticket article
    with third parties. This identifier can be then potentially abused
    in order to impersonate the agent user.</changelog>
  <changelog author="chris@computersalat.de" date="1573387200">- Update to 5.0.38
  https://community.otrs.com/release-notes-otrs-5s-patch-level-38/
- fix for boo#1156431
  * (CVE-2019-16375, OSA-2019-13)
    Stored XXS
    An attacker who is logged into OTRS as an agent or customer user
    with appropriate permissions can create a carefully crafted
    string containing malicious JavaScript code as an article body.
    This malicious code is executed when an agent compose an answer
    to the original article.</changelog>
  <changelog author="chris@computersalat.de" date="1577534400">- Update 5.0.39
  https://community.otrs.com/otrs-community-edition-5s-patch-level-39/
- fix for boo#1157001
  * (CVE-2019-18180, OSA-2019-15)
    Denial of service
    OTRS can be put into an endless loop by providing filenames with
    overly long extensions. This applies to the PostMaster
    (sending in email) and also upload
    (attaching files to mails, for example).
  * (CVE-2019-18179, OSA-2019-14)
    Information Disclosure
    An attacker who is logged into OTRS as an agent is able to list
    tickets assigned to other agents, which are in the queue where
    attacker doesn?t have permissions.</changelog>
  <changelog author="chris@computersalat.de" date="1578657600">- Update to 5.0.40
  https://community.otrs.com/otrs-community-edition-5s-patch-level-40/
- fix for boo#1160663
  * (CVE-2020-1766, OSA-2020-02)
    Improper handling of uploaded inline images
    Due to improper handling of uploaded images it is possible in very
    unlikely and rare conditions to force the agents browser to execute
    malicious javascript from a special crafted SVG file rendered as
    inline jpg file.
  * (CVE-2020-1765, OSA-2020-01)
    Spoofing of From field in several screens
    An improper control of parameters allows the spoofing of the from
    fields of the following screens:
    AgentTicketCompose, AgentTicketForward, AgentTicketBounce and
    AgentTicketEmailOutbound
  * run bin/otrs.Console.pl Maint::Config::Rebuild after the upgrade
- !!! This is latest update for 5.0.x Release by OTRS !!!</changelog>
  <changelog author="chris@computersalat.de" date="1586260800">- Update to 5.0.42
  https://community.otrs.com/otrs-community-edition-5s-patch-level-42/
- fix for boo#1168029 (CVE-2020-1773, OSA-2020-10)
  * Session / Password / Password token leak
    An attacker with the ability to generate session IDs or password
    reset tokens, either by being able to authenticate or by exploiting
    OSA-2020-09, may be able to predict other users session IDs,
    password reset tokens and automatically generated passwords.
- fix for boo#1168029 (CVE-2020-1772, OSA-2020-09)
  * Information Disclosure
    It?s possible to craft Lost Password requests with wildcards in
    the Token value, which allows attacker to retrieve valid Token(s),
    generated by users which already requested new passwords.
- fix for boo#1168030 (CVE-2020-1771, OSA-2020-08)
  * Possible XSS in Customer user address book
    Attacker is able craft an article with a link to the customer
    address book with malicious content (JavaScript). When agent opens
    the link, JavaScript code is executed due to the missing parameter
    encoding.
- fix for boo#1168031 (CVE-2020-1770, OSA-2020-07)
  * Information disclosure in support bundle files
    Support bundle generated files could contain sensitive information
    that might be unwanted to be disclosed.
- fix for boo#1168032 (CVE-2020-1769, OSA-2020-06)
  * Autocomplete in the form login screens
    In the login screens (in agent and customer interface), Username
    and Password fields use autocomplete, which might be considered
    as security issue.
- Update to 5.0.41
  https://community.otrs.com/otrs-community-edition-5s-patch-level-41/
  * bug#14912 - Installer refers to non-existing documentation
- add code to upgrade OTRS from 4 to 5
  READ UPGRADING.SUSE
  * steps 1 to 4 are done by rpm pkg
  * steps 5 to *END* need to be done manully cause of DB backup
- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
</package>
</otherdata>