Subject: [Pkg-cacti-maint] Bug#868080: CVE-2017-11163

From: Moritz Muehlenhoff <[email-masked]>
Date: Tue, 11 Jul 2017 23:13:39 +0200

Package: cacti
Severity: important
Tags: security

This was assigned CVE-2017-11163:
https://github.com/Cacti/cacti/issues/847

Cheers,
        Moritz

---

From: [email-masked] (Debian Bug Tracking System)
Date: Wed, 12 Jul 2017 05:15:03 +0000

Your message dated Wed, 12 Jul 2017 07:12:15 +0200
with message-id <[email-masked]>
and subject line Re: Bug#868080: CVE-2017-11163
has caused the Debian Bug report #868080,
regarding CVE-2017-11163
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

-- 
868080: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=868080
Debian Bug Tracking System
Contact [email-masked] with problems

Subject: CVE-2017-11163
From: Moritz Muehlenhoff <[email-masked]>
To: Debian Bug Tracking System <[email-masked]>
Date: Tue, 11 Jul 2017 23:13:39 +0200

Package: cacti
Severity: important
Tags: security

Cheers,
        Moritz

Subject: Re: Bug#868080: CVE-2017-11163
From: Paul Gevers <[email-masked]>
To: [email-masked]
Date: Wed, 12 Jul 2017 07:12:15 +0200

Version: 1.1.12+ds1-1

Hi Moritz,

> https://github.com/Cacti/cacti/issues/847

According to upstream already fixed by the patch for CVE-2017-10970,
which is in unstable.

Probably, but haven't checked yet, this is new in 1.x, so I expect non
of the releases of Debian should be susceptible. Obviously one shouldn't
take my hunch feeling for this.

I'll investigate further tonight.

Paul

---

From: Paul Gevers <[email-masked]>
Date: Wed, 12 Jul 2017 20:11:23 +0200

Hi,

> https://github.com/Cacti/cacti/issues/847

The root cause of this CVE is the same as CVE-2017-11163. Upstream is
even surprised that a new CVE is assigned to this issue, see:
https://github.com/Cacti/cacti/issues/847#issuecomment-314746041 and the
next message (cigamit is upstream, mortenstevens is a Fedora maintainer).

Paul