Subject: [Pkg-cacti-maint] Bug#872478: cacti: XSS in spikekill.php via method parameter

From: Salvatore Bonaccorso <[email-masked]>
Date: Thu, 17 Aug 2017 21:17:42 +0200

Source: cacti
Version: 1.1.17+ds1-1
Severity: important
Tags: patch upstream security fixed-upstream
Forwarded: https://github.com/Cacti/cacti/issues/907

hi

Opening the tracking bug for the XSS issue reported at
https://github.com/Cacti/cacti/issues/907 .  Upstream fix:
https://github.com/Cacti/cacti/commit/a032ce0be6a4ea47862c594e40a619ac8de1ef99

A CVE has been requested for this issue.

Regards,
Salvatore

---

From: Salvatore Bonaccorso <[email-masked]>
Date: Fri, 18 Aug 2017 07:06:38 +0200

Control: retitle -1 cacti: CVE-2017-12927: XSS in spikekill.php via method parameter

> A CVE has been requested for this issue.

CVE-2017-12927 has been assigned.

Regards,
Salvatore

---

From: [email-masked] (Debian Bug Tracking System)
Date: Fri, 18 Aug 2017 05:09:04 +0000

Processing control commands:

> retitle -1 cacti: CVE-2017-12927: XSS in spikekill.php via method parameter
Bug #872478 [src:cacti] cacti: XSS in spikekill.php via method parameter
Changed Bug title to 'cacti: CVE-2017-12927: XSS in spikekill.php via method parameter' from 'cacti: XSS in spikekill.php via method parameter'.

-- 
872478: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872478
Debian Bug Tracking System
Contact [email-masked] with problems

---

From: [email-masked] (Debian Bug Tracking System)
Date: Fri, 18 Aug 2017 21:06:08 +0000

Your message dated Fri, 18 Aug 2017 21:04:47 +0000
with message-id <[email-masked]>
and subject line Bug#872478: fixed in cacti 1.1.17+ds1-2
has caused the Debian Bug report #872478,
regarding cacti: CVE-2017-12927: XSS in spikekill.php via method parameter
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

Subject: cacti: XSS in spikekill.php via method parameter
From: Salvatore Bonaccorso <[email-masked]>
To: Debian Bug Tracking System <[email-masked]>
Date: Thu, 17 Aug 2017 21:17:42 +0200

Source: cacti
Version: 1.1.17+ds1-1
Severity: important

hi

Regards,
Salvatore

Subject: Bug#872478: fixed in cacti 1.1.17+ds1-2
From: Paul Gevers <[email-masked]>
To: [email-masked]
Date: Fri, 18 Aug 2017 21:04:47 +0000

Source: cacti
Source-Version: 1.1.17+ds1-2

We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email-masked],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Gevers <[email-masked]> (supplier of updated cacti package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email-masked])

Format: 1.8
Date: Fri, 18 Aug 2017 21:15:23 +0200
Source: cacti
Binary: cacti
Architecture: source
Version: 1.1.17+ds1-2
Distribution: unstable
Urgency: medium
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Description:
 cacti      - web interface for graphing of monitoring systems
Closes: 872478
Changes:
 cacti (1.1.17+ds1-2) unstable; urgency=medium
 .
   * CVE-2017-12927 XSS vulnerability in spikekill.php (Closes: #872478)
   * [tests] fix grep expression to unblock Ubuntu
   * [tests] Add improve-boost-logging-on-fresh-installs.patch and don't
     filter on the fixed messages
   * Fix typo in previous changelog message
Checksums-Sha1:
 4d48fdf08829da83f2e16e36ba54b9925ddf3927 2131 cacti_1.1.17+ds1-2.dsc
 e6e1e53bc5ef6129731a5855c2ccf878159b1879 50984 cacti_1.1.17+ds1-2.debian.tar.xz
Checksums-Sha256:
 46c3596481f4d121e036e8dbe473a168df6ee1704683e7d8795d3d338e26392b 2131 cacti_1.1.17+ds1-2.dsc
 989e8de7e098553728a6b8e9bdd3c2912900781bbeacaea37bc2ddafb3f0e115 50984 cacti_1.1.17+ds1-2.debian.tar.xz
Files:
 dc406326a31e2729c435d6ceb8839767 2131 web extra cacti_1.1.17+ds1-2.dsc
 ed932125f6aa9854e60979b990a4d56c 50984 web extra cacti_1.1.17+ds1-2.debian.tar.xz