CVE-2020-1774: Debian Linux

Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days.

When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix them and to send private key to the third-party instead of public key. This issue affects ((OTRS)) Community Edition: 5.0.42 and prior versions, 6.0.27 and prior versions. OTRS: 7.0.16 and prior versions.

Affected products

• Debian Debian Linux: version 8.0 only
• Otrs Otrs: from 5.0.0, up to and including 5.0.42; from 6.0.0, up to and including 6.0.27; from 7.0.0, up to and including 7.0.16

Published 2020-04-28. Last modified 2026-06-17.