Subject: [Pkg-cacti-maint] Bug#947374: cacti: CVE-2019-17357

From: Salvatore Bonaccorso <[email-masked]>
Date: Wed, 25 Dec 2019 22:24:40 +0100

Source: cacti
Version: 1.2.7+ds1-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/Cacti/cacti/issues/3025

Hi,

The following vulnerability was published for cacti.

CVE-2019-17357[0]:
|When viewing graphs, some input variables are not properly checked (SQL
|injection possible)

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-17357
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17357
[1] https://github.com/Cacti/cacti/issues/3025
[2] https://github.com/Cacti/cacti/commit/d6dc48503bbcde0717e7a93df7638fd4796200f4

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

---

From: "Debian Bug Tracking System" <[email-masked]>
Date: Sat, 28 Dec 2019 17:06:12 +0000

Your message dated Sat, 28 Dec 2019 17:04:34 +0000
with message-id <[email-masked]>
and subject line Bug#947374: fixed in cacti 1.2.8+ds1-1
has caused the Debian Bug report #947374,
regarding cacti: CVE-2019-17357
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

-- 
947374: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947374
Debian Bug Tracking System
Contact [email-masked] with problems

Subject: cacti: CVE-2019-17357
From: Salvatore Bonaccorso <[email-masked]>
To: Debian Bug Tracking System <[email-masked]>
Date: Wed, 25 Dec 2019 22:24:40 +0100

Source: cacti
Version: 1.2.7+ds1-1
Severity: important
Tags: security upstream

Hi,

CVE-2019-17357[0]:

Regards,
Salvatore

Subject: Bug#947374: fixed in cacti 1.2.8+ds1-1
From: Paul Gevers <[email-masked]>
To: [email-masked]
Date: Sat, 28 Dec 2019 17:04:34 +0000

Source: cacti
Source-Version: 1.2.8+ds1-1

We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email-masked],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Gevers <[email-masked]> (supplier of updated cacti package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email-masked])

Format: 1.8
Date: Sat, 28 Dec 2019 17:44:58 +0100
Source: cacti
Architecture: source
Version: 1.2.8+ds1-1
Distribution: unstable
Urgency: medium
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Closes: 947374 947375
Changes:
 cacti (1.2.8+ds1-1) unstable; urgency=medium
 .
   * New upstream version 1.2.8+ds1
     CVE-2019-17357 When viewing graphs, some input variables are not
     properly checked (SQL injection possible) (Closes: #947374)
     CVE-2019-17358 When deserializating data, ensure basic sanitization
     has been performed (Closes: #947375)
Checksums-Sha1:
 3fe56b8eb9afbb6555f87566a814ac77a364a404 2221 cacti_1.2.8+ds1-1.dsc
 2c5f965cfd3e33dc30de061954e7160ccba5e69d 13511938 cacti_1.2.8+ds1.orig-docs-source.tar.gz
 d1af8048f738f17bfdc93b376424b6ff83c48cb3 7200520 cacti_1.2.8+ds1.orig.tar.gz
 0b7fe37c18245ab959798b903f3d04610ef87ee4 53476 cacti_1.2.8+ds1-1.debian.tar.xz
Checksums-Sha256:
 085edee4cf21b007a7100036a335ae25c9cbf77c8ad7d708786b05dd8a7351e9 2221 cacti_1.2.8+ds1-1.dsc
 d05a34352c6613c1c49f8869f240fd961c06e0f6ecf51b4898166ff24aa50176 13511938 cacti_1.2.8+ds1.orig-docs-source.tar.gz
 8be59fd173d2c20b67fb39dfb176a71f81bbfad672005ecd78b315d68b1a8661 7200520 cacti_1.2.8+ds1.orig.tar.gz
 a368bc93cde32ba3e149df80925785e94a16573861171fd5784af0d7f3f45349 53476 cacti_1.2.8+ds1-1.debian.tar.xz
Files:
 8544df36acee4e462402ac3386968969 2221 web optional cacti_1.2.8+ds1-1.dsc
 1af3c4e6bf66a875cde9f69d1f8fb2a4 13511938 web optional cacti_1.2.8+ds1.orig-docs-source.tar.gz
 04f421b8d25ecaca7901cfdfe2bb85c3 7200520 web optional cacti_1.2.8+ds1.orig.tar.gz
 ddfc298107a677666ab22270c56ca4b2 53476 web optional cacti_1.2.8+ds1-1.debian.tar.xz

---

From: Hugo Lefeuvre <[email-masked]>
Date: Sun, 29 Dec 2019 19:00:18 +0100

Hi,

after taking a look at the source code, this vulnerability does not seem to
affect cacti 0.8.8h+ds1-10 (stretch).

rationale: template_id is sanitized at line 1048:
input_validate_input_number(get_request_var_request("template_id"));

This check was replaced over time and gradually disappeared, which explains
the security issue in recent versions.

Chris: you worked on cacti in jessie and triaged it not-affected. Jessie
has a similar version, does this match your findings?

Just to make sure, I contacted upstream to get reproduction instructions
before I triage this not-affected in stretch in the tracker.

cheers,
Hugo

-- 
                Hugo Lefeuvre (hle)    |    www.owl.eu.com
RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD
ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C

---

From: "Chris Lamb" <[email-masked]>
Date: Sun, 29 Dec 2019 18:03:15 +0000

Hi Hugo,

> input_validate_input_number(get_request_var_request("template_id"));
[…]
> has a similar version, does this match your findings?

Ah yes; well-spotted. :)

Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      [email-masked] 🍥 chris-lamb.co.uk
       `-

---

From: Hugo Lefeuvre <[email-masked]>
Date: Mon, 30 Dec 2019 11:19:01 +0100

> > has a similar version, does this match your findings?

Ack, same for stretch in the end. :)

BTW, there is a confusion in the jessie update, the changelog says it fixes
CVE-2019-17357 and the patch is called CVE-2019-17357.patch, but the
actual CVE being fixed is CVE-2019-17358, not CVE-2019-17357.

cheers,
Hugo

---

From: "Debian Bug Tracking System" <[email-masked]>
Date: Sat, 25 Jan 2020 19:03:06 +0000

Your message dated Sat, 25 Jan 2020 19:02:09 +0000
with message-id <[email-masked]>
and subject line Bug#947374: fixed in cacti 1.2.2+ds1-2+deb10u2
has caused the Debian Bug report #947374,
regarding cacti: CVE-2019-17357
to be marked as done.

Source: cacti
Version: 1.2.7+ds1-1
Severity: important
Tags: security upstream

Hi,

CVE-2019-17357[0]:

Regards,
Salvatore

Subject: Bug#947374: fixed in cacti 1.2.2+ds1-2+deb10u2
From: Hugo Lefeuvre <[email-masked]>
To: [email-masked]
Date: Sat, 25 Jan 2020 19:02:09 +0000

Source: cacti
Source-Version: 1.2.2+ds1-2+deb10u2

Debian distribution maintenance software
pp.
Hugo Lefeuvre <[email-masked]> (supplier of updated cacti package)

Format: 1.8
Date: Sun, 29 Dec 2019 19:53:28 +0100
Source: cacti
Binary: cacti
Architecture: source all
Version: 1.2.2+ds1-2+deb10u2
Distribution: buster-security
Urgency: medium
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Hugo Lefeuvre <[email-masked]>
Description:
 cacti      - web interface for graphing of monitoring systems
Closes: 941036 947374 947375
Changes:
 cacti (1.2.2+ds1-2+deb10u2) buster-security; urgency=medium
 .
   * Non-maintainer upload by the Security Team.
   * Acknowledgements to Paul Gevers!
   * CVE-2019-17358: insufficient validation of form input leading to unsafe
     unserialization operations and memory corruption (Closes: #947375).
   * CVE-2019-17357: SQL injection vulnerability in graphs.php (Closes: #947374).
   * CVE-2019-16723: Authentication bypass allows unprivileged users to view all
     graphs (Closes: #941036).
Checksums-Sha1:
 99a8abb2c5bc046f080181d894fd84068bb0ae1e 2309 cacti_1.2.2+ds1-2+deb10u2.dsc
 5bcf2410f398f22ea55696428dfdc9f033303e0c 12751572 cacti_1.2.2+ds1.orig-docs-source.tar.gz
 d0a763c27c1c9778e782a14abae3075dbfd3c8a7 3702668 cacti_1.2.2+ds1.orig.tar.xz
 73c2fac2a49c30f5ac9df9f437cb5bb2b2ce15be 56528 cacti_1.2.2+ds1-2+deb10u2.debian.tar.xz
 119270eac1b481d9e69eefd5314e8986170e928c 14877344 cacti_1.2.2+ds1-2+deb10u2_all.deb
 e59537c1ba34d5c0f696787b2893e0722fde6449 5652 cacti_1.2.2+ds1-2+deb10u2_amd64.buildinfo
Checksums-Sha256:
 9934d1b2a4edf7c9fd05cfffd49f9e36786835c23ddb90f7ddbee9092328bbad 2309 cacti_1.2.2+ds1-2+deb10u2.dsc
 5d94359ea0b15cfe8f96ddc9999394594563cb34de2bb500a54f7b27565b44b4 12751572 cacti_1.2.2+ds1.orig-docs-source.tar.gz
 45d263e2cbc7aa40e162c35adbe45229bd231e16faf082dbc01fb36403140bef 3702668 cacti_1.2.2+ds1.orig.tar.xz
 971a74243dae8e84776c44a89ad51537e43e3c3a4d6ee2d7cc1609a8ffabf01a 56528 cacti_1.2.2+ds1-2+deb10u2.debian.tar.xz
 f5474e0ac396e709714ca88d5b5abbb72906703fdf1b3ece647a8085cf997ce8 14877344 cacti_1.2.2+ds1-2+deb10u2_all.deb
 54db11f5f0ee2dea59ea7d47837d8c415b537f9b8e25f90bd010bc76990eb5af 5652 cacti_1.2.2+ds1-2+deb10u2_amd64.buildinfo
Files:
 53ae1a58c40f1b514739e8718024886b 2309 web optional cacti_1.2.2+ds1-2+deb10u2.dsc
 ebdf0461474378c083051b44ce15aa34 12751572 web optional cacti_1.2.2+ds1.orig-docs-source.tar.gz
 b14ae7d08f482659a44d76cbeca91ebd 3702668 web optional cacti_1.2.2+ds1.orig.tar.xz
 0aab4a16c3683b20eaa0fc1e6b1e71cf 56528 web optional cacti_1.2.2+ds1-2+deb10u2.debian.tar.xz
 c7e2734369eaaaa9d35e5d4ebfe9e7a9 14877344 web optional cacti_1.2.2+ds1-2+deb10u2_all.deb
 a2ac8c4be621c2e1a60ba7faa44c1995 5652 web optional cacti_1.2.2+ds1-2+deb10u2_amd64.buildinfo