Subject: [Pkg-cacti-maint] Bug#870354: cacti: CVE-2017-12066

From: Salvatore Bonaccorso <[email-masked]>
Date: Tue, 01 Aug 2017 13:32:53 +0200

Source: cacti
Version: 1.1.15+ds1-1
Severity: important
Tags: security upstream patch
Forwarded: https://github.com/Cacti/cacti/issues/877

Hi,

the following vulnerability was published for cacti.

CVE-2017-12066[0]:
| Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in
| Cacti before 1.1.16 allows remote authenticated users to inject
| arbitrary web script or HTML via specially crafted HTTP Referer
| headers, related to the $cancel_url variable. NOTE: this vulnerability
| exists because of an incomplete fix (lack of the htmlspecialchars
| ENT_QUOTES flag) for CVE-2017-11163.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-12066
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12066
[1] https://github.com/Cacti/cacti/issues/877

(yes the same commit and upstream issue as CVE-2017-12065 since the
reporter mixed/collected the report in one upstream issue). 

Regards,
Salvatore

---

From: [email-masked] (Debian Bug Tracking System)
Date: Thu, 03 Aug 2017 15:06:08 +0000

Your message dated Thu, 03 Aug 2017 15:04:25 +0000
with message-id <[email-masked]>
and subject line Bug#870354: fixed in cacti 1.1.16+ds1-1
has caused the Debian Bug report #870354,
regarding cacti: CVE-2017-12066
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

-- 
870354: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870354
Debian Bug Tracking System
Contact [email-masked] with problems

Subject: cacti: CVE-2017-12066
From: Salvatore Bonaccorso <[email-masked]>
To: Debian Bug Tracking System <[email-masked]>
Date: Tue, 01 Aug 2017 13:32:53 +0200

Source: cacti
Version: 1.1.15+ds1-1
Severity: important

Hi,

CVE-2017-12066[0]:

Regards,
Salvatore

Subject: Bug#870354: fixed in cacti 1.1.16+ds1-1
From: Paul Gevers <[email-masked]>
To: [email-masked]
Date: Thu, 03 Aug 2017 15:04:25 +0000

Source: cacti
Source-Version: 1.1.16+ds1-1

We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email-masked],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Gevers <[email-masked]> (supplier of updated cacti package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email-masked])

Format: 1.8
Date: Thu, 03 Aug 2017 09:38:54 -0400
Source: cacti
Binary: cacti
Architecture: source
Version: 1.1.16+ds1-1
Distribution: unstable
Urgency: medium
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Description:
 cacti      - web interface for graphing of monitoring systems
Closes: 870353 870354
Changes:
 cacti (1.1.16+ds1-1) unstable; urgency=medium
 .
   * New upstream release
     - Fixes CVE-2017-12065 spikekill.php might allow remote attackers to
       execute arbitrary code via the avgnan, outlier-start, or outlier-end
       parameter (Closes: #870353)
     - Fixes CVE-2017-12066 Cross-site scripting (XSS) vulnerability in
       aggregate_graphs.php (Closes: #870354)
Checksums-Sha1:
 62c817247fe9baeea7cc96912ab22e0b3fd41bc9 2131 cacti_1.1.16+ds1-1.dsc
 0ee9c46aacb14248d3e8a3e9b2dff9a246e868b3 66892 cacti_1.1.16+ds1.orig-docs-source.tar.xz
 3cf5f6db0872c5376ae5195a2dab26252d3847d0 3792319 cacti_1.1.16+ds1.orig.tar.gz
 430a8dcded52e82c2aa7e60cc2ea57321d1ebf1e 50024 cacti_1.1.16+ds1-1.debian.tar.xz
Checksums-Sha256:
 a3ee5d9e4832d8904bdf920e68cb6c5949a313cbbc2738df79a103c4b731182d 2131 cacti_1.1.16+ds1-1.dsc
 30931fb415c746524db2d752f8be47f568f7f4dc3ba0cc0a3f184c3951b337e9 66892 cacti_1.1.16+ds1.orig-docs-source.tar.xz
 912f5caaed9c8d879c7887fa6fd138db521bb98c9376ac299a8369f26a07e35e 3792319 cacti_1.1.16+ds1.orig.tar.gz
 6dda77be2427c897970070170fec63d8e0b62ec07c39b9668fa41c18ffeb1a84 50024 cacti_1.1.16+ds1-1.debian.tar.xz
Files:
 cfd2c14153a3e795748ae61f1a1b8a98 2131 web extra cacti_1.1.16+ds1-1.dsc
 091493e53be845d24ac5bd061acf796f 66892 web extra cacti_1.1.16+ds1.orig-docs-source.tar.xz
 a56dc0aa22340fae507a50f3be0f571e 3792319 web extra cacti_1.1.16+ds1.orig.tar.gz
 37abc3bd56bf7fcde9484b66305a6144 50024 web extra cacti_1.1.16+ds1-1.debian.tar.xz