Subject: [Pkg-cacti-maint] Bug#949997: cacti: CVE-2020-7237

From: Salvatore Bonaccorso <[email-masked]>
Date: Tue, 28 Jan 2020 08:41:50 +0100

Source: cacti
Version: 1.2.8+ds1-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/Cacti/cacti/issues/3201

Hi,

The following vulnerability was published for cacti.

CVE-2020-7237[0]:
| Cacti 1.2.8 allows Remote Code Execution (by privileged users) via
| shell metacharacters in the Performance Boost Debug Log field of
| poller_automation.php. OS commands are executed when a new poller
| cycle begins. The attacker must be authenticated, and must have access
| to modify the Performance Settings of the product.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-7237
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7237
[1] https://github.com/Cacti/cacti/issues/3201

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

---

From: "Debian Bug Tracking System" <[email-masked]>
Date: Thu, 13 Feb 2020 20:45:07 +0000

Your message dated Thu, 13 Feb 2020 20:42:41 +0000
with message-id <[email-masked]>
and subject line Bug#949997: fixed in cacti 1.2.9+ds1-1
has caused the Debian Bug report #949997,
regarding cacti: CVE-2020-7237
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

-- 
949997: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=949997
Debian Bug Tracking System
Contact [email-masked] with problems

Subject: cacti: CVE-2020-7237
From: Salvatore Bonaccorso <[email-masked]>
To: Debian Bug Tracking System <[email-masked]>
Date: Tue, 28 Jan 2020 08:41:50 +0100

Source: cacti
Version: 1.2.8+ds1-1
Severity: important
Tags: security upstream

Hi,

CVE-2020-7237[0]:

Regards,
Salvatore

Subject: Bug#949997: fixed in cacti 1.2.9+ds1-1
From: Debian FTP Masters <[email-masked]>
To: [email-masked]
Date: Thu, 13 Feb 2020 20:42:41 +0000

Source: cacti
Source-Version: 1.2.9+ds1-1

We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email-masked],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Gevers <[email-masked]> (supplier of updated cacti package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email-masked])

Format: 1.8
Date: Thu, 13 Feb 2020 20:38:01 +0100
Source: cacti
Architecture: source
Version: 1.2.9+ds1-1
Distribution: unstable
Urgency: medium
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Closes: 949996 949997
Changes:
 cacti (1.2.9+ds1-1) unstable; urgency=medium
 .
   * New upstream version 1.2.9+ds1
     CVE-2020-7106 Remote Code Execution (by privileged users) via shell
     metacharacters in the Performance Boost Debug Log field of
     poller_automation.php. (Closes: #949996)
     CVE-2020-7237 Stored XSS in data_sources.php,
     color_templates_item.php, graphs.php, graph_items.php,
     lib/api_automation.php, user_admin.php, and user_group_admin.php, as
     demonstrated by the description parameter in data_sources.php (Closes:
     #949997)
Checksums-Sha1:
 70ac7c88c8f5afe0ac17c47fcaebed60a7ba8cfe 2106 cacti_1.2.9+ds1-1.dsc
 c8922b88e74ee62fdd2d77b85ddbe7de1a165f96 13512524 cacti_1.2.9+ds1.orig-docs-source.tar.gz
 c08262fde3456121ddc7eaa3afa347bdd743cdf6 7225339 cacti_1.2.9+ds1.orig.tar.gz
 3cf6abb04fb26e505516d304867d2e53c1503ccf 53648 cacti_1.2.9+ds1-1.debian.tar.xz
Checksums-Sha256:
 e00e1e3351f009aedd28996b11c7a4b719d55cb9c29738f99294294e41e9d089 2106 cacti_1.2.9+ds1-1.dsc
 054c00f8453f2b836fdf165e25f4ce66705c0aa075084b570c3f707a622bcb83 13512524 cacti_1.2.9+ds1.orig-docs-source.tar.gz
 4e8147ed82939ce7b7a8d04a3ae7727aad5904ebe83591e69cf3352aea427db8 7225339 cacti_1.2.9+ds1.orig.tar.gz
 0e5ff0b87c8a328128552a5e1836078230ebde968dcfcbb5c78fe82086a38529 53648 cacti_1.2.9+ds1-1.debian.tar.xz
Files:
 6eebf2e084540df7f97377ea5d7ea2c2 2106 web optional cacti_1.2.9+ds1-1.dsc
 77a4557cb0f6c21d910da7a4590da3c5 13512524 web optional cacti_1.2.9+ds1.orig-docs-source.tar.gz
 76128ec28bd5eadc9f860a5c46d6f6e1 7225339 web optional cacti_1.2.9+ds1.orig.tar.gz
 156bf382847a16c11d7c21b794305ed3 53648 web optional cacti_1.2.9+ds1-1.debian.tar.xz