Subject: [Pkg-cacti-maint] Bug#963139: cacti: CVE-2020-14295

From: Salvatore Bonaccorso <[email-masked]>
Date: Fri, 19 Jun 2020 17:17:56 +0200

Source: cacti
Version: 1.2.12+ds1-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/Cacti/cacti/issues/3622

Hi,

The following vulnerability was published for cacti. There is no patch
yet, but a proposed change mentioned in the upstream issue.

CVE-2020-14295[0]:
| A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to
| inject SQL via the filter parameter. This can lead to remote command
| execution because the product accepts stacked queries.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-14295
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14295
[1] https://github.com/Cacti/cacti/issues/3622

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

---

From: "Debian Bug Tracking System" <[email-masked]>
Date: Mon, 27 Jul 2020 20:03:05 +0000

Your message dated Mon, 27 Jul 2020 21:59:34 +0200
with message-id <[email-masked]>
and subject line Re: cacti: CVE-2020-14295
has caused the Debian Bug report #963139,
regarding cacti: CVE-2020-14295
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

-- 
963139: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=963139
Debian Bug Tracking System
Contact [email-masked] with problems

Subject: cacti: CVE-2020-14295
From: Salvatore Bonaccorso <[email-masked]>
To: Debian Bug Tracking System <[email-masked]>
Date: Fri, 19 Jun 2020 17:17:56 +0200

Source: cacti
Version: 1.2.12+ds1-1
Severity: important
Tags: security upstream

Hi,

CVE-2020-14295[0]:

Regards,
Salvatore

Subject: Re: cacti: CVE-2020-14295
From: Paul Gevers <[email-masked]>
To: [email-masked]
Date: Mon, 27 Jul 2020 21:59:34 +0200

Version: 1.2.13+ds1-1

Hi,

> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

I just uploaded the new upstream version, but I forgot to close this bug
report as I forgot about its existence and forgot to check the open bug
reports. There are more security issues mentioned in the upstream changelog.

Paul