Subject: [Pkg-cacti-maint] Bug#833420: cacti: Incomplete fix for CVE-2016-2313

From: Salvatore Bonaccorso <[email-masked]>
Date: Thu, 04 Aug 2016 08:22:30 +0200

Source: cacti
Version: 0.8.8h+ds1-4
Severity: important
Tags: security upstream
Forwarded: http://bugs.cacti.net/view.php?id=2697

Hi Paul,

As originally reported to [0,1] the fix for CVE-2016-2313 seems
incomplete. This affects the unstable version and the version which is
waiting in jessie-proposed-updates.

Filling the bug to track the issue.

 [0] https://lists.debian.org/debian-lts/2016/07/msg00164.html
 [1] http://bugs.cacti.net/view.php?id=2697

Regards,
Salvatore

---

From: [email-masked] (Debian Bug Tracking System)
Date: Thu, 04 Aug 2016 08:27:12 +0000

Processing control commands:

> tags -1 - security
Bug #833420 [src:cacti] cacti: Incomplete fix for CVE-2016-2313
Removed tag(s) security.

-- 
833420: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=833420
Debian Bug Tracking System
Contact [email-masked] with problems

---

From: Salvatore Bonaccorso <[email-masked]>
Date: Thu, 4 Aug 2016 10:23:17 +0200

Control: tags -1 - security

Remvoving the security tag. If I understand it correctly, the
incomplete fix has not directly security implication, but considered
a regression in functionality (guests cannot login anymore). So guess
this does not need a separate CVE for the incomplete fix applied.

Regards,
Salvatore

---

From: [email-masked] (Debian Bug Tracking System)
Date: Mon, 05 Sep 2016 22:21:11 +0000

Your message dated Mon, 05 Sep 2016 22:19:55 +0000
with message-id <[email-masked]>
and subject line Bug#833420: fixed in cacti 0.8.8h+ds1-5
has caused the Debian Bug report #833420,
regarding cacti: Incomplete fix for CVE-2016-2313
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

Subject: cacti: Incomplete fix for CVE-2016-2313
From: Salvatore Bonaccorso <[email-masked]>
To: Debian Bug Tracking System <[email-masked]>
Date: Thu, 04 Aug 2016 08:22:30 +0200

Source: cacti
Version: 0.8.8h+ds1-4
Severity: important
Tags: security upstream

Hi Paul,

Regards,
Salvatore

Subject: Bug#833420: fixed in cacti 0.8.8h+ds1-5
From: Paul Gevers <[email-masked]>
To: [email-masked]
Date: Mon, 05 Sep 2016 22:19:55 +0000

Source: cacti
Source-Version: 0.8.8h+ds1-5

We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email-masked],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Gevers <[email-masked]> (supplier of updated cacti package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email-masked])

Format: 1.8
Date: Mon, 05 Sep 2016 21:10:12 +0200
Source: cacti
Binary: cacti
Architecture: source
Version: 0.8.8h+ds1-5
Distribution: unstable
Urgency: medium
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Description:
 cacti      - web interface for graphing of monitoring systems
Closes: 833420
Changes:
 cacti (0.8.8h+ds1-5) unstable; urgency=medium
 .
   [ Emilio Pozuelo Monfort ]
   * CVE-2016-2313-guest-auth.patch:
     + Fix regression in the fix for CVE-2016-2313 that broke guest user
       logins. Thanks to Matus Uhlar for the report. (Closes: #833420)
 .
   [ Paul Gevers ]
   * Recommend default-mysql-server instead of MariaDB and MySQL
Checksums-Sha1:
 e6cae9887f873abb0a390c49202a74dd9bc96395 1619 cacti_0.8.8h+ds1-5.dsc
 3b54d32435f4d6a5f8140fe8e353a92e3b369963 48900 cacti_0.8.8h+ds1-5.debian.tar.xz
Checksums-Sha256:
 f72f99f17441d4aaa1a267a1a8ddd4029de39b9d435abf683aa37692715f46f9 1619 cacti_0.8.8h+ds1-5.dsc
 648747bc2c44c43694816a6167bc84c311c7ff0a740564827c32dc9c57d635fa 48900 cacti_0.8.8h+ds1-5.debian.tar.xz
Files:
 ca129725fd31ef42725f298b59440d0e 1619 web extra cacti_0.8.8h+ds1-5.dsc
 67d8f89eaf671c234da00fc014e1bb19 48900 web extra cacti_0.8.8h+ds1-5.debian.tar.xz