Subject: [Pkg-cacti-maint] Wheezy update of cacti?

From: Ola Lundqvist <[email-masked]>
Date: Wed, 8 Nov 2017 21:21:41 +0100

Dear maintainer,

The Debian LTS team would like to fix the security issues which are
currently open in the Wheezy version of cacti:
https://security-tracker.debian.org/tracker/CVE-2017-16641
https://security-tracker.debian.org/tracker/CVE-2017-16660
https://security-tracker.debian.org/tracker/CVE-2017-16661

Would you like to take care of this yourself?

If yes, please follow the workflow we have defined here:
https://wiki.debian.org/LTS/Development

If that workflow is a burden to you, feel free to just prepare an
updated source package and send it to [email-masked]
(via a debdiff, or with an URL pointing to the source package,
or even with a pointer to your packaging repository), and the members
of the LTS team will take care of the rest. Indicate clearly whether you
have tested the updated package or not.

If you don't want to take care of this update, it's not a problem, we
will do our best with your package. Just let us know whether you would
like to review and/or test the updated package before it gets released.

You can also opt-out from receiving future similar emails in your
answer and then the LTS Team will take care of cacti updates
for the LTS releases.

Thank you very much.

Ola Lundqvist,
  on behalf of the Debian LTS team.

PS: A member of the LTS team might start working on this update at
any point in time. You can verify whether someone is registered
on this update in this file:
https://anonscm.debian.org/viewvc/secure-testing/data/dla-needed.txt?view=markup

---

From: Paul Gevers <[email-masked]>
Date: Thu, 9 Nov 2017 18:51:53 +0100

Hi Ola

> Would you like to take care of this yourself?

I expect (but haven't verified yet) that this is all only concerning
buster and sid. Cacti got a major revamp this year.

If it concerns Wheezy, I'll let you know, otherwise, I'll update the
security tracker. That is, if you don't beat me to it. When Wheezy is
affected and I find time before you do, I may do the Wheezy upload
myself. If you beat me to it, can you push your changes to the git archive?

Paul

---

From: Ola Lundqvist <[email-masked]>
Date: Mon, 13 Nov 2017 20:15:19 +0100

Hi Paul

You are right two of the issues are not an issue in wheezy. I have
marked them accordingly. However one remains. I did not find time to
look through the last ome.

// Ola

-- 
 --- Inguza Technology AB --- MSc in Information Technology ----
/  [email-masked]                    Folkebogatan 26            \
|  [email-masked]                   654 68 KARLSTAD            |
|  http://inguza.com/                Mobile: +46 (0)70-332 1551 |
\  gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9  /
 ---------------------------------------------------------------

---

From: Paul Gevers <[email-masked]>
Date: Mon, 13 Nov 2017 21:30:03 +0100

Hi Ola,

> look through the last ome.

I have already looked at that, it is present. But please see my comments
in bug 881110¹ about how to treat it.

I have, in the process of this, also filed bug 1072 upstream (about
CVE-2009-4112).

I think that until there is a patch for CVE-2009-4112, one can ignore
fixing CVE-2017-16641. However, please read the upstream bug 1072 about
the potential progress.

Paul

¹ https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=881110
² https://github.com/Cacti/cacti/issues/1072