Subject: [Pkg-cacti-maint] Bug#947375: cacti: CVE-2019-17358

From: Salvatore Bonaccorso <[email-masked]>
Date: Wed, 25 Dec 2019 22:27:48 +0100

Source: cacti
Version: 1.2.7+ds1-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/Cacti/cacti/issues/3026

Hi,

The following vulnerability was published for cacti.

CVE-2019-17358[0]:
| Cacti through 1.2.7 is affected by multiple instances of
| lib/functions.php unsafe deserialization of user-controlled data to
| populate arrays. An authenticated attacker could use this to influence
| object data values and control actions taken by Cacti or potentially
| cause memory corruption in the PHP module.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-17358
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17358
[1] https://github.com/Cacti/cacti/issues/3026
[2] https://github.com/Cacti/cacti/commit/adf221344359f5b02b8aed43dfb6b33ae5d708c8

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

---

From: "Debian Bug Tracking System" <[email-masked]>
Date: Sat, 28 Dec 2019 17:06:15 +0000

Your message dated Sat, 28 Dec 2019 17:04:34 +0000
with message-id <[email-masked]>
and subject line Bug#947375: fixed in cacti 1.2.8+ds1-1
has caused the Debian Bug report #947375,
regarding cacti: CVE-2019-17358
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

-- 
947375: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947375
Debian Bug Tracking System
Contact [email-masked] with problems

Subject: cacti: CVE-2019-17358
From: Salvatore Bonaccorso <[email-masked]>
To: Debian Bug Tracking System <[email-masked]>
Date: Wed, 25 Dec 2019 22:27:48 +0100

Source: cacti
Version: 1.2.7+ds1-1
Severity: important
Tags: security upstream

Hi,

CVE-2019-17358[0]:

Regards,
Salvatore

Subject: Bug#947375: fixed in cacti 1.2.8+ds1-1
From: Paul Gevers <[email-masked]>
To: [email-masked]
Date: Sat, 28 Dec 2019 17:04:34 +0000

Source: cacti
Source-Version: 1.2.8+ds1-1

We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email-masked],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Gevers <[email-masked]> (supplier of updated cacti package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email-masked])

Format: 1.8
Date: Sat, 28 Dec 2019 17:44:58 +0100
Source: cacti
Architecture: source
Version: 1.2.8+ds1-1
Distribution: unstable
Urgency: medium
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Closes: 947374 947375
Changes:
 cacti (1.2.8+ds1-1) unstable; urgency=medium
 .
   * New upstream version 1.2.8+ds1
     CVE-2019-17357 When viewing graphs, some input variables are not
     properly checked (SQL injection possible) (Closes: #947374)
     CVE-2019-17358 When deserializating data, ensure basic sanitization
     has been performed (Closes: #947375)
Checksums-Sha1:
 3fe56b8eb9afbb6555f87566a814ac77a364a404 2221 cacti_1.2.8+ds1-1.dsc
 2c5f965cfd3e33dc30de061954e7160ccba5e69d 13511938 cacti_1.2.8+ds1.orig-docs-source.tar.gz
 d1af8048f738f17bfdc93b376424b6ff83c48cb3 7200520 cacti_1.2.8+ds1.orig.tar.gz
 0b7fe37c18245ab959798b903f3d04610ef87ee4 53476 cacti_1.2.8+ds1-1.debian.tar.xz
Checksums-Sha256:
 085edee4cf21b007a7100036a335ae25c9cbf77c8ad7d708786b05dd8a7351e9 2221 cacti_1.2.8+ds1-1.dsc
 d05a34352c6613c1c49f8869f240fd961c06e0f6ecf51b4898166ff24aa50176 13511938 cacti_1.2.8+ds1.orig-docs-source.tar.gz
 8be59fd173d2c20b67fb39dfb176a71f81bbfad672005ecd78b315d68b1a8661 7200520 cacti_1.2.8+ds1.orig.tar.gz
 a368bc93cde32ba3e149df80925785e94a16573861171fd5784af0d7f3f45349 53476 cacti_1.2.8+ds1-1.debian.tar.xz
Files:
 8544df36acee4e462402ac3386968969 2221 web optional cacti_1.2.8+ds1-1.dsc
 1af3c4e6bf66a875cde9f69d1f8fb2a4 13511938 web optional cacti_1.2.8+ds1.orig-docs-source.tar.gz
 04f421b8d25ecaca7901cfdfe2bb85c3 7200520 web optional cacti_1.2.8+ds1.orig.tar.gz
 ddfc298107a677666ab22270c56ca4b2 53476 web optional cacti_1.2.8+ds1-1.debian.tar.xz

---

From: "Debian Bug Tracking System" <[email-masked]>
Date: Mon, 20 Jan 2020 23:21:13 +0000

Your message dated Mon, 20 Jan 2020 23:18:07 +0000
with message-id <[email-masked]>
and subject line Bug#947375: fixed in cacti 0.8.8h+ds1-10+deb9u1
has caused the Debian Bug report #947375,
regarding cacti: CVE-2019-17358
to be marked as done.

Source: cacti
Version: 1.2.7+ds1-1
Severity: important
Tags: security upstream

Hi,

CVE-2019-17358[0]:

Regards,
Salvatore

Subject: Bug#947375: fixed in cacti 0.8.8h+ds1-10+deb9u1
From: Hugo Lefeuvre <[email-masked]>
To: [email-masked]
Date: Mon, 20 Jan 2020 23:18:07 +0000

Source: cacti
Source-Version: 0.8.8h+ds1-10+deb9u1

Debian distribution maintenance software
pp.
Hugo Lefeuvre <[email-masked]> (supplier of updated cacti package)

Format: 1.8
Date: Sun, 29 Dec 2019 20:37:02 +0100
Source: cacti
Binary: cacti
Architecture: source all
Version: 0.8.8h+ds1-10+deb9u1
Distribution: stretch-security
Urgency: high
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Hugo Lefeuvre <[email-masked]>
Description:
 cacti      - web interface for graphing of monitoring systems
Closes: 947375
Changes:
 cacti (0.8.8h+ds1-10+deb9u1) stretch-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * CVE-2019-17358: insufficient validation of form input leading to unsafe
     unserialization operations and memory corruption (Closes: #947375).
Checksums-Sha1:
 56bc9b728a0c2d2a61c45db9446777c37ff8caed 1837 cacti_0.8.8h+ds1-10+deb9u1.dsc
 d999403cd29250f956e8db95952eb6dc5f8be9a8 2154671 cacti_0.8.8h+ds1.orig.tar.gz
 053292951cd395027ec8df80994a460000872d1a 49320 cacti_0.8.8h+ds1-10+deb9u1.debian.tar.xz
 ed6beaaa3b6feb6b94b1fea2113304c1031a2c8e 1864580 cacti_0.8.8h+ds1-10+deb9u1_all.deb
 f637b0333f6a2d642ebb8ac8bd9d536210e93e97 5635 cacti_0.8.8h+ds1-10+deb9u1_amd64.buildinfo
Checksums-Sha256:
 bd5dfe2e045f632f58c920e68cd39863f781cb1a261b357127ab18dbf0f92609 1837 cacti_0.8.8h+ds1-10+deb9u1.dsc
 75f9e455b6bbd16c14ef1fb92426900f86e067512eb0d64b87b7eb97bbe78efc 2154671 cacti_0.8.8h+ds1.orig.tar.gz
 bbb5e513828ad59082530a2a8cedc1afa7bae414638ec6ed6ea4e9c1d537097a 49320 cacti_0.8.8h+ds1-10+deb9u1.debian.tar.xz
 b752da41ed64bd1ff0583a1db4cca8133e0ed093837ba14665250d908fe69f87 1864580 cacti_0.8.8h+ds1-10+deb9u1_all.deb
 673c42e1f32371f2cff13d4ca17bd6776d17efaf8ffc765124eb79d3452bb5a3 5635 cacti_0.8.8h+ds1-10+deb9u1_amd64.buildinfo
Files:
 245be451636508e3cc731a66ea65e58a 1837 web extra cacti_0.8.8h+ds1-10+deb9u1.dsc
 8ff7049c7a1b4984d0bb35f079c9c671 2154671 web extra cacti_0.8.8h+ds1.orig.tar.gz
 6dc93f103585d8d8cec7a558411eead8 49320 web extra cacti_0.8.8h+ds1-10+deb9u1.debian.tar.xz
 1f84cf5258c464f6f390e64227ccc75a 1864580 web extra cacti_0.8.8h+ds1-10+deb9u1_all.deb
 6333ef9756000b7b3359e5a76555ed41 5635 web extra cacti_0.8.8h+ds1-10+deb9u1_amd64.buildinfo

---

From: "Debian Bug Tracking System" <[email-masked]>
Date: Sat, 25 Jan 2020 19:03:08 +0000

Your message dated Sat, 25 Jan 2020 19:02:09 +0000
with message-id <[email-masked]>
and subject line Bug#947375: fixed in cacti 1.2.2+ds1-2+deb10u2
has caused the Debian Bug report #947375,
regarding cacti: CVE-2019-17358
to be marked as done.

Source: cacti
Version: 1.2.7+ds1-1
Severity: important
Tags: security upstream

Hi,

CVE-2019-17358[0]:

Regards,
Salvatore

Subject: Bug#947375: fixed in cacti 1.2.2+ds1-2+deb10u2
From: Hugo Lefeuvre <[email-masked]>
To: [email-masked]
Date: Sat, 25 Jan 2020 19:02:09 +0000

Source: cacti
Source-Version: 1.2.2+ds1-2+deb10u2

Format: 1.8
Date: Sun, 29 Dec 2019 19:53:28 +0100
Source: cacti
Binary: cacti
Architecture: source all
Version: 1.2.2+ds1-2+deb10u2
Distribution: buster-security
Urgency: medium
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Hugo Lefeuvre <[email-masked]>
Description:
 cacti      - web interface for graphing of monitoring systems
Closes: 941036 947374 947375
Changes:
 cacti (1.2.2+ds1-2+deb10u2) buster-security; urgency=medium
 .
   * Non-maintainer upload by the Security Team.
   * Acknowledgements to Paul Gevers!
   * CVE-2019-17358: insufficient validation of form input leading to unsafe
     unserialization operations and memory corruption (Closes: #947375).
   * CVE-2019-17357: SQL injection vulnerability in graphs.php (Closes: #947374).
   * CVE-2019-16723: Authentication bypass allows unprivileged users to view all
     graphs (Closes: #941036).
Checksums-Sha1:
 99a8abb2c5bc046f080181d894fd84068bb0ae1e 2309 cacti_1.2.2+ds1-2+deb10u2.dsc
 5bcf2410f398f22ea55696428dfdc9f033303e0c 12751572 cacti_1.2.2+ds1.orig-docs-source.tar.gz
 d0a763c27c1c9778e782a14abae3075dbfd3c8a7 3702668 cacti_1.2.2+ds1.orig.tar.xz
 73c2fac2a49c30f5ac9df9f437cb5bb2b2ce15be 56528 cacti_1.2.2+ds1-2+deb10u2.debian.tar.xz
 119270eac1b481d9e69eefd5314e8986170e928c 14877344 cacti_1.2.2+ds1-2+deb10u2_all.deb
 e59537c1ba34d5c0f696787b2893e0722fde6449 5652 cacti_1.2.2+ds1-2+deb10u2_amd64.buildinfo
Checksums-Sha256:
 9934d1b2a4edf7c9fd05cfffd49f9e36786835c23ddb90f7ddbee9092328bbad 2309 cacti_1.2.2+ds1-2+deb10u2.dsc
 5d94359ea0b15cfe8f96ddc9999394594563cb34de2bb500a54f7b27565b44b4 12751572 cacti_1.2.2+ds1.orig-docs-source.tar.gz
 45d263e2cbc7aa40e162c35adbe45229bd231e16faf082dbc01fb36403140bef 3702668 cacti_1.2.2+ds1.orig.tar.xz
 971a74243dae8e84776c44a89ad51537e43e3c3a4d6ee2d7cc1609a8ffabf01a 56528 cacti_1.2.2+ds1-2+deb10u2.debian.tar.xz
 f5474e0ac396e709714ca88d5b5abbb72906703fdf1b3ece647a8085cf997ce8 14877344 cacti_1.2.2+ds1-2+deb10u2_all.deb
 54db11f5f0ee2dea59ea7d47837d8c415b537f9b8e25f90bd010bc76990eb5af 5652 cacti_1.2.2+ds1-2+deb10u2_amd64.buildinfo
Files:
 53ae1a58c40f1b514739e8718024886b 2309 web optional cacti_1.2.2+ds1-2+deb10u2.dsc
 ebdf0461474378c083051b44ce15aa34 12751572 web optional cacti_1.2.2+ds1.orig-docs-source.tar.gz
 b14ae7d08f482659a44d76cbeca91ebd 3702668 web optional cacti_1.2.2+ds1.orig.tar.xz
 0aab4a16c3683b20eaa0fc1e6b1e71cf 56528 web optional cacti_1.2.2+ds1-2+deb10u2.debian.tar.xz
 c7e2734369eaaaa9d35e5d4ebfe9e7a9 14877344 web optional cacti_1.2.2+ds1-2+deb10u2_all.deb
 a2ac8c4be621c2e1a60ba7faa44c1995 5652 web optional cacti_1.2.2+ds1-2+deb10u2_amd64.buildinfo