Subject: [Pkg-cacti-maint] Bug#867532: cacti: CVE-2017-10970: XSS vulnerability via link.php

From: Salvatore Bonaccorso <[email-masked]>
Date: Fri, 07 Jul 2017 06:35:31 +0200

Source: cacti
Version: 1.1.10+ds1-6
Severity: important
Tags: patch security upstream
Forwarded: https://github.com/Cacti/cacti/issues/838

Hi,

the following vulnerability was published for cacti.

CVE-2017-10970[0]:
| Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12
| allows remote anonymous users to inject arbitrary web script or HTML
| via the id parameter, related to the die_html_input_error function in
| lib/html_validate.php.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-10970
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10970
[1] https://github.com/Cacti/cacti/issues/838

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

---

From: Salvatore Bonaccorso <[email-masked]>
Date: Fri, 7 Jul 2017 06:48:00 +0200

Upstream commit 11e7294de8e344765d6fefd8295ca01f6b0fa7a7 introduced:

better validation log messages

If there is an unchecked request variable, let the developer know what
variable and what it was set to.

Unless I'm completely mistaken that should be the commit which
introduced the issue. As such stretch and jessie should not be
affected.

Regards,
Salvatore

---

From: [email-masked] (Debian Bug Tracking System)
Date: Fri, 07 Jul 2017 07:39:07 +0000

Processing control commands:

> notfound -1 0.8.8h+ds1-10
Bug #867532 [src:cacti] cacti: CVE-2017-10970: XSS vulnerability via link.php
Ignoring request to alter found versions of bug #867532 to the same values previously set
> found -1 1.1.3+ds1-1
Bug #867532 [src:cacti] cacti: CVE-2017-10970: XSS vulnerability via link.php
Marked as found in versions cacti/1.1.3+ds1-1.
> severity -1 serious
Bug #867532 [src:cacti] cacti: CVE-2017-10970: XSS vulnerability via link.php
Severity set to 'serious' from 'important'

-- 
867532: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=867532
Debian Bug Tracking System
Contact [email-masked] with problems

---

From: Paul Gevers <[email-masked]>
Date: Fri, 7 Jul 2017 09:36:13 +0200

Control: notfound -1 0.8.8h+ds1-10
Control: found -1 1.1.3+ds1-1
Control: severity -1 serious

> introduced the issue. As such stretch and jessie should not be

I believe your conclusion is correct. Set affected versions accordingly.
Rather busy, but I should be able to fix this in unstable. Let's prevent
this issue migrating to testing.

Paul

---

From: [email-masked] (Debian Bug Tracking System)
Date: Fri, 07 Jul 2017 21:06:03 +0000

Your message dated Fri, 07 Jul 2017 21:03:55 +0000
with message-id <[email-masked]>
and subject line Bug#867532: fixed in cacti 1.1.12+ds1-1
has caused the Debian Bug report #867532,
regarding cacti: CVE-2017-10970: XSS vulnerability via link.php
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

Subject: cacti: CVE-2017-10970: XSS vulnerability via link.php
From: Salvatore Bonaccorso <[email-masked]>
To: Debian Bug Tracking System <[email-masked]>
Date: Fri, 07 Jul 2017 06:35:31 +0200

Source: cacti
Version: 1.1.10+ds1-6
Severity: important

Hi,

CVE-2017-10970[0]:

Regards,
Salvatore

Subject: Bug#867532: fixed in cacti 1.1.12+ds1-1
From: Paul Gevers <[email-masked]>
To: [email-masked]
Date: Fri, 07 Jul 2017 21:03:55 +0000

Source: cacti
Source-Version: 1.1.12+ds1-1

We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email-masked],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Gevers <[email-masked]> (supplier of updated cacti package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email-masked])

Format: 1.8
Date: Fri, 07 Jul 2017 21:07:43 +0200
Source: cacti
Binary: cacti
Architecture: source
Version: 1.1.12+ds1-1
Distribution: unstable
Urgency: medium
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Description:
 cacti      - web interface for graphing of monitoring systems
Closes: 867532
Changes:
 cacti (1.1.12+ds1-1) unstable; urgency=medium
 .
   * New upstream release
   * CVE-2017-10970 XSS vulnerability via link.php fixed (Closes: #867532)
   * Add version to jquery-tablesorter
   * Make sure that autopkgtests at least run again
Checksums-Sha1:
 f964455db7167901dbc2fec29430ac9681afa264 2131 cacti_1.1.12+ds1-1.dsc
 f405c3aedec346ae34730c393751258ca2285b5c 77309 cacti_1.1.12+ds1.orig-docs-source.tar.gz
 bb2be437a4b82218e96e10f5b6daa2ab949f1331 3790582 cacti_1.1.12+ds1.orig.tar.gz
 87f3bf027396511747498f40502ebb0c1691d977 50388 cacti_1.1.12+ds1-1.debian.tar.xz
Checksums-Sha256:
 0d2ef617214f1bab3d5f58da96c3099e3fa943ff290a5a7c91ee7317b22f5971 2131 cacti_1.1.12+ds1-1.dsc
 83f103e99fe92162830a984daa0a70a5ee7362840e774f157bfdab9cfc8c8a1f 77309 cacti_1.1.12+ds1.orig-docs-source.tar.gz
 2dbc69066f3cab6e9fa6eb4d6a5d34b7f62ffe0acef7f517a5be95ede7b2c768 3790582 cacti_1.1.12+ds1.orig.tar.gz
 d0c381eac466fab52161e9a05e1193fcc204193fd27fad7510fdd5afab9c7540 50388 cacti_1.1.12+ds1-1.debian.tar.xz
Files:
 2924ad3475c19af0a6009a321ccfec31 2131 web extra cacti_1.1.12+ds1-1.dsc
 7ea58851062685a07347e8bd4a3e2e04 77309 web extra cacti_1.1.12+ds1.orig-docs-source.tar.gz
 fbf199e8c334d8975f3dc8b044ed43a0 3790582 web extra cacti_1.1.12+ds1.orig.tar.gz
 8593af7176efee3c2fa1b517ac84c2ac 50388 web extra cacti_1.1.12+ds1-1.debian.tar.xz