Subject: [Pkg-cacti-maint] cacti_1.2.2+ds1-2+deb10u3_source.changes ACCEPTED into proposed-updates->stable-new, proposed-updates

From: Debian FTP Masters <[email-masked]>
Date: Thu, 09 Jul 2020 19:17:08 +0000

Accepted:

Format: 1.8
Date: Thu, 18 Jun 2020 22:34:41 +0200
Source: cacti
Architecture: source
Version: 1.2.2+ds1-2+deb10u3
Distribution: buster
Urgency: medium
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Closes: 949996 949997
Changes:
 cacti (1.2.2+ds1-2+deb10u3) buster; urgency=medium
 .
   * Unix timestamps after Sep 13 2020 are rejected as graph start/end
     arguments (Upstream bug #3245)
   * CVE-2020-7237: Remote Code Execution (by privileged users) via shell
     metacharacters in the Performance Boost Debug Log field of
     poller_automation.php. OS commands are executed when a new poller
     cycle begins. The attacker must be authenticated, and must have access
     to modify the Performance Settings of the product. (Closes: #949997)
   * CVE-2020-7106: XSS in data_sources.php, color_templates_item.php,
     graphs.php, graph_items.php, lib/api_automation.php, user_admin.php,
     and user_group_admin.php, as demonstrated by the description parameter
     in data_sources.php (a raw string from the database that is displayed
     by $header to trigger the XSS). (Closes: #949996)
   * CVE-2020-13230: Disabling an user account does not immediately
     invalidate any permissions granted to that account (e.g., permission
     to view logs)
   * CVE-2020-13231: auth_profile.php?action=edit allows CSRF for an admin
     email change
Checksums-Sha1:
 776e1f8104f9608392149eac349892aeaa3c629c 2261 cacti_1.2.2+ds1-2+deb10u3.dsc
 7a5d661d63bc2dba0120ec874b77ddf574bcc4d6 66172 cacti_1.2.2+ds1-2+deb10u3.debian.tar.xz
Checksums-Sha256:
 b9b4889ddd6c1ca37f9f89ae53f82a19f4178cde1b4a85a439486a311d5b47cf 2261 cacti_1.2.2+ds1-2+deb10u3.dsc
 fdea59cd06101307c0f338b0c18e4db11831118a6d6c23db28fe2358b9142c52 66172 cacti_1.2.2+ds1-2+deb10u3.debian.tar.xz
Files:
 62001e04fb7ce7a1edcfbf813c59d241 2261 web optional cacti_1.2.2+ds1-2+deb10u3.dsc
 fac92e683ab5c6eb93076bb4b80c7f7c 66172 web optional cacti_1.2.2+ds1-2+deb10u3.debian.tar.xz

Thank you for your contribution to Debian.