Subject: [Pkg-cacti-maint] cacti_1.1.27+ds1-3_source.changes ACCEPTED into unstable

From: Debian FTP Masters <[email-masked]>
Date: Tue, 14 Nov 2017 20:49:34 +0000

Accepted:

Format: 1.8
Date: Tue, 14 Nov 2017 20:14:34 +0100
Source: cacti
Binary: cacti
Architecture: source
Version: 1.1.27+ds1-3
Distribution: unstable
Urgency: medium
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Description:
 cacti      - web interface for graphing of monitoring systems
Closes: 881110
Changes:
 cacti (1.1.27+ds1-3) unstable; urgency=medium
 .
   * CVE-2017-16641: remote authenticated administrators can execute
     arbitrary os commands via the path_rrdtool parameter in an action=save
     request to settings.php (Closes: #881110)
   * CVE-2017-16660: remote authenticated administrators can conduct Remote
     Code Execution attacks by placing the Log Path under the web root, and
     then making a remote_agent.php request containing PHP code in a
     Client-ip header
   * CVE-2017-16661: remote authenticated administrators can read arbitrary
     files accessible by the web-server user by placing the Log Path into a
     private directory, and then making a clog.php?filename= request
   * CVE-2017-16785: reflected XSS via the PATH_INFO to host.php
     (reintroduction of CVE-2017-15194)
   * Bump standards to 4.1.1
   * Set Priority to optional
Checksums-Sha1:
 6da0c05e6b24552f8e3f4c0d995152531237f5e1 2134 cacti_1.1.27+ds1-3.dsc
 e0d1f509fb465f2c1676b254fc0d5b1362e9f7f5 56092 cacti_1.1.27+ds1-3.debian.tar.xz
Checksums-Sha256:
 9d77784c2545398d29f325c99764b1aebeb8966bb7d12e5c0dda78e7673306f3 2134 cacti_1.1.27+ds1-3.dsc
 519db95eb5fd254f309faad31aaeb2d79fa1b2bbe8a8c604aa8b8fdcc7203f44 56092 cacti_1.1.27+ds1-3.debian.tar.xz
Files:
 2f7335b2759d8227a2b170074abf98de 2134 web optional cacti_1.1.27+ds1-3.dsc
 fd6375c1fc789d1654364421b949f5ac 56092 web optional cacti_1.1.27+ds1-3.debian.tar.xz

Thank you for your contribution to Debian.