Subject: [Pkg-cacti-maint] Bug#807599: CVE-2015-8369: cacti: SQL injection in graph.php

From: Henri Salo <[email-masked]>
Date: Thu, 10 Dec 2015 19:42:01 +0200

Package: cacti
Version: 0.8.8f+ds1-2
Severity: important
Tags: security

The following vulnerability was published for Cacti. CVE identifier
CVE-2015-8369 was assigned for this isssue.

http://bugs.cacti.net/view.php?id=2646

- -- 
Henri Salo

---

From: [email-masked] (Debian Bug Tracking System)
Date: Sat, 12 Dec 2015 20:15:07 +0000

Your message dated Sat, 12 Dec 2015 21:12:13 +0100
with message-id <[email-masked]>
and subject line Re: cacti_0.8.8f+ds1-3_source.changes ACCEPTED into unstable
has caused the Debian Bug report #807599,
regarding CVE-2015-8369: cacti: SQL injection in graph.php
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

-- 
807599: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=807599
Debian Bug Tracking System
Contact [email-masked] with problems

Subject: CVE-2015-8369: cacti: SQL injection in graph.php
From: Henri Salo <[email-masked]>
To: [email-masked]
Date: Thu, 10 Dec 2015 19:42:01 +0200

Package: cacti
Version: 0.8.8f+ds1-2
Severity: important
Tags: security

- -- 
Henri Salo

Subject: Re: cacti_0.8.8f+ds1-3_source.changes ACCEPTED into unstable
From: Paul Gevers <[email-masked]>
To: [email-masked]
Date: Sat, 12 Dec 2015 21:12:13 +0100

Version: cacti_0.8.8f+ds1-3

Oops, should have added the bug number in the changelog.

Paul

On 12-12-15 16:49, Debian FTP Masters wrote:
> 
> 
> Accepted:
> 
> Format: 1.8
> Date: Sat, 12 Dec 2015 14:03:40 +0100
> Source: cacti
> Binary: cacti
> Architecture: source
> Version: 0.8.8f+ds1-3
> Distribution: unstable
> Urgency: high
> Maintainer: Cacti Maintainer <[email-masked]>
> Changed-By: Paul Gevers <[email-masked]>
> Description:
>  cacti      - web interface for graphing of monitoring systems
> Changes:
>  cacti (0.8.8f+ds1-3) unstable; urgency=high
>  .
>    * Add upstream patch to fix
>      - CVE-2015-8369 SQL Injection vulnerability in graph.php
> Checksums-Sha1:
>  0e3effa604919160a9c50ddb572ea522592c72d3 1591 cacti_0.8.8f+ds1-3.dsc
>  cfe129d32c3b5da91661113972ae4ad91ae25a9f 48644 cacti_0.8.8f+ds1-3.debian.tar.xz
> Checksums-Sha256:
>  431ae3d2f481148dde2c6f85f62d8d156c9bf4fb735aee137815b810e919616b 1591 cacti_0.8.8f+ds1-3.dsc
>  5f0357cc6cf682c9bd51d0bec56e4492a6b024e2bc6cc4134fc561ab9347ea3e 48644 cacti_0.8.8f+ds1-3.debian.tar.xz
> Files:
>  9357808f53f18c90ad443df3ab2dc66f 1591 web extra cacti_0.8.8f+ds1-3.dsc
>  f60b687f3cc8586452e59a04adc5fc83 48644 web extra cacti_0.8.8f+ds1-3.debian.tar.xz
> 
> 
> 
> Thank you for your contribution to Debian.
>

---

From: [email-masked] (Debian Bug Tracking System)
Date: Sun, 20 Dec 2015 18:06:09 +0000

Your message dated Sun, 20 Dec 2015 18:02:07 +0000
with message-id <[email-masked]>
and subject line Bug#807599: fixed in cacti 0.8.8b+dfsg-8+deb8u3
has caused the Debian Bug report #807599,
regarding CVE-2015-8369: cacti: SQL injection in graph.php
to be marked as done.

Package: cacti
Version: 0.8.8f+ds1-2
Severity: important
Tags: security

- -- 
Henri Salo

Subject: Bug#807599: fixed in cacti 0.8.8b+dfsg-8+deb8u3
From: Paul Gevers <[email-masked]>
To: [email-masked]
Date: Sun, 20 Dec 2015 18:02:07 +0000

Source: cacti
Source-Version: 0.8.8b+dfsg-8+deb8u3

We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email-masked],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Gevers <[email-masked]> (supplier of updated cacti package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email-masked])

Format: 1.8
Date: Sat, 12 Dec 2015 21:08:55 +0100
Source: cacti
Binary: cacti
Architecture: source all
Version: 0.8.8b+dfsg-8+deb8u3
Distribution: jessie-security
Urgency: high
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Description:
 cacti      - web interface for graphing of monitoring systems
Closes: 807599
Changes:
 cacti (0.8.8b+dfsg-8+deb8u3) jessie-security; urgency=high
 .
   * Add upstream patch to fix (Closes: #807599)
     - CVE-2015-8369 SQL Injection vulnerability in graph.php
Checksums-Sha1:
 820351ad00af38e9cee5efc638b418f79fb2c1c1 1666 cacti_0.8.8b+dfsg-8+deb8u3.dsc
 3e1ca4403fdbdfca9e213e9d5282119fe1a40d6e 114752 cacti_0.8.8b+dfsg-8+deb8u3.debian.tar.xz
 971b12f134c85f1e515edb5ff2d530f807950283 1894486 cacti_0.8.8b+dfsg-8+deb8u3_all.deb
Checksums-Sha256:
 3eb721fdb6aaaa0fbf5c055c72ae63a0828011ad890da2b8e9a99b2a77fd73b1 1666 cacti_0.8.8b+dfsg-8+deb8u3.dsc
 0881091897454584f71c0ce3872056d04b7e25af70e10195eac6a7037cb1f61e 114752 cacti_0.8.8b+dfsg-8+deb8u3.debian.tar.xz
 a78b7c21c96a26313c6d9b5823f4395fb79322d011552d58658142cfdafe2993 1894486 cacti_0.8.8b+dfsg-8+deb8u3_all.deb
Files:
 18e8b266e1b53add261f1340dff43742 1666 web extra cacti_0.8.8b+dfsg-8+deb8u3.dsc
 efd5a882b199c5d95ec139d215a218d9 114752 web extra cacti_0.8.8b+dfsg-8+deb8u3.debian.tar.xz
 33ba46abed654ca6534cf9195085ef0f 1894486 web extra cacti_0.8.8b+dfsg-8+deb8u3_all.deb

---

From: [email-masked] (Debian Bug Tracking System)
Date: Sun, 20 Dec 2015 18:09:08 +0000

Your message dated Sun, 20 Dec 2015 18:07:40 +0000
with message-id <[email-masked]>
and subject line Bug#807599: fixed in cacti 0.8.8a+dfsg-5+deb7u7
has caused the Debian Bug report #807599,
regarding CVE-2015-8369: cacti: SQL injection in graph.php
to be marked as done.

Package: cacti
Version: 0.8.8f+ds1-2
Severity: important
Tags: security

- -- 
Henri Salo

Subject: Bug#807599: fixed in cacti 0.8.8a+dfsg-5+deb7u7
From: Paul Gevers <[email-masked]>
To: [email-masked]
Date: Sun, 20 Dec 2015 18:07:40 +0000

Source: cacti
Source-Version: 0.8.8a+dfsg-5+deb7u7

Format: 1.8
Date: Sat, 12 Dec 2015 21:24:23 +0100
Source: cacti
Binary: cacti
Architecture: source all
Version: 0.8.8a+dfsg-5+deb7u7
Distribution: wheezy-security
Urgency: high
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Description: 
 cacti      - web interface for graphing of monitoring systems
Closes: 807599
Changes: 
 cacti (0.8.8a+dfsg-5+deb7u7) wheezy-security; urgency=high
 .
   * Add upstream patch to fix (Closes: #807599)
     - CVE-2015-8369 SQL Injection vulnerability in graph.php
Checksums-Sha1: 
 5e02775aefebac18ee559f075cfaa386db219ec8 1666 cacti_0.8.8a+dfsg-5+deb7u7.dsc
 aaa44fdc280e3b424db77a27d606f61ab1516a40 135989 cacti_0.8.8a+dfsg-5+deb7u7.debian.tar.gz
 0d880fa2a0fbe6b2112142f9d5dd8f96d314ccd8 2152916 cacti_0.8.8a+dfsg-5+deb7u7_all.deb
Checksums-Sha256: 
 c75b941b356d0b875261defa1d349eca60a11182e270a89d1153a3653a4505f1 1666 cacti_0.8.8a+dfsg-5+deb7u7.dsc
 9d6a6160c2e590f8a849a5143eafdc165d4127cff525501c4f1b034d52157e43 135989 cacti_0.8.8a+dfsg-5+deb7u7.debian.tar.gz
 9ad4c407644ec6a731923fd83ccfe807c1a9a8f863b063455fb74f22a1887a1d 2152916 cacti_0.8.8a+dfsg-5+deb7u7_all.deb
Files: 
 12052fc7153535b516ef1ae1ec4457ce 1666 web extra cacti_0.8.8a+dfsg-5+deb7u7.dsc
 c054c3acf573852c0b096302b178df16 135989 web extra cacti_0.8.8a+dfsg-5+deb7u7.debian.tar.gz
 6ea8ac73b2c816f35ddaba48202b4330 2152916 web extra cacti_0.8.8a+dfsg-5+deb7u7_all.deb

---

From: [email-masked] (Debian Bug Tracking System)
Date: Sat, 26 Dec 2015 13:51:13 +0000

Your message dated Sat, 26 Dec 2015 13:49:25 +0000
with message-id <[email-masked]>
and subject line Bug#807599: fixed in cacti 0.8.7g-1+squeeze9+deb6u11
has caused the Debian Bug report #807599,
regarding CVE-2015-8369: cacti: SQL injection in graph.php
to be marked as done.

Package: cacti
Version: 0.8.8f+ds1-2
Severity: important
Tags: security

- -- 
Henri Salo

Subject: Bug#807599: fixed in cacti 0.8.7g-1+squeeze9+deb6u11
From: Chris Lamb <[email-masked]>
To: [email-masked]
Date: Sat, 26 Dec 2015 13:49:25 +0000

Source: cacti
Source-Version: 0.8.7g-1+squeeze9+deb6u11

Debian distribution maintenance software
pp.
Chris Lamb <[email-masked]> (supplier of updated cacti package)

Format: 1.8
Date: Sat, 26 Dec 2015 12:53:42 +0000
Source: cacti
Binary: cacti
Architecture: source all
Version: 0.8.7g-1+squeeze9+deb6u11
Distribution: squeeze-lts
Urgency: high
Maintainer: Sean Finney <[email-masked]>
Changed-By: Chris Lamb <[email-masked]>
Description: 
 cacti      - Frontend to rrdtool for monitoring systems and services
Closes: 807599
Changes: 
 cacti (0.8.7g-1+squeeze9+deb6u11) squeeze-lts; urgency=high
 .
   * CVE-2015-8369: Fix SQL Injection vulnerability in graph.php
     (Closes: #807599)
   * CVE-2015-8377: Fix SQL Injection vulnerability in graph_new.php.
Checksums-Sha1: 
 bddd60412c69c4e1b7a86e0bbc55eddbca3cdc55 1804 cacti_0.8.7g-1+squeeze9+deb6u11.dsc
 a5a710653e158b1bc950de0a1e2c60ee364bf782 2236916 cacti_0.8.7g.orig.tar.gz
 89efcc31000d58a9f2774f8565c449bb5291f947 74050 cacti_0.8.7g-1+squeeze9+deb6u11.diff.gz
 39a85759f07481877122546890699b5a77019af6 2103088 cacti_0.8.7g-1+squeeze9+deb6u11_all.deb
Checksums-Sha256: 
 303801fed5a81338cc39ffe6da14b1d19da352d2e4dc1cb36f23b4ba4e5ec3b4 1804 cacti_0.8.7g-1+squeeze9+deb6u11.dsc
 d09b3bf54f51bd42b2db0a62521cf6e408716978f75d6509ec56027c49c44585 2236916 cacti_0.8.7g.orig.tar.gz
 04613910e3bbbf92630be352ea671845963dddda509d523cbc925ed1039c267c 74050 cacti_0.8.7g-1+squeeze9+deb6u11.diff.gz
 1bcdad6b25e7e3c671c1d5e43b2e5037629fa8596f5da5093228008b8c52f202 2103088 cacti_0.8.7g-1+squeeze9+deb6u11_all.deb
Files: 
 7a77c89ce7f437a091e9c0dd41941bf6 1804 web extra cacti_0.8.7g-1+squeeze9+deb6u11.dsc
 268421cb1a58d3444f7ecbddb4c4b016 2236916 web extra cacti_0.8.7g.orig.tar.gz
 ba6fb190e44e36250e9716defb4323b0 74050 web extra cacti_0.8.7g-1+squeeze9+deb6u11.diff.gz
 330748584de0b6588c2aaadfdfdd9860 2103088 web extra cacti_0.8.7g-1+squeeze9+deb6u11_all.deb

---

From: [email-masked] (Debian Bug Tracking System)
Date: Mon, 04 Jan 2016 12:24:04 +0000

Your message dated Mon, 04 Jan 2016 12:20:25 +0000
with message-id <[email-masked]>
and subject line Bug#807599: fixed in cacti 0.8.7g-1+squeeze9+deb6u13
has caused the Debian Bug report #807599,
regarding CVE-2015-8369: cacti: SQL injection in graph.php
to be marked as done.

Package: cacti
Version: 0.8.8f+ds1-2
Severity: important
Tags: security

- -- 
Henri Salo

Subject: Bug#807599: fixed in cacti 0.8.7g-1+squeeze9+deb6u13
From: Chris Lamb <[email-masked]>
To: [email-masked]
Date: Mon, 04 Jan 2016 12:20:25 +0000

Source: cacti
Source-Version: 0.8.7g-1+squeeze9+deb6u13

Format: 1.8
Date: Mon, 04 Jan 2016 11:37:24 +0000
Source: cacti
Binary: cacti
Architecture: source all
Version: 0.8.7g-1+squeeze9+deb6u13
Distribution: squeeze-lts
Urgency: high
Maintainer: Sean Finney <[email-masked]>
Changed-By: Chris Lamb <[email-masked]>
Description: 
 cacti      - Frontend to rrdtool for monitoring systems and services
Closes: 807599 809260
Changes: 
 cacti (0.8.7g-1+squeeze9+deb6u13) squeeze-lts; urgency=high
 .
   * Correct yet another regression in patch for CVE-2015-8369, introduced in
     0.8.7g-1+squeeze9+deb6u12. Thanks to Marcel Meckel <[email-masked]>
     (Closes: #809260, #807599)
Checksums-Sha1: 
 75b63fbf05d95ebe971234ab996c3bdf883252c0 1804 cacti_0.8.7g-1+squeeze9+deb6u13.dsc
 a5a710653e158b1bc950de0a1e2c60ee364bf782 2236916 cacti_0.8.7g.orig.tar.gz
 80caa2da964794c63c779602f0b84d2162cc667a 74415 cacti_0.8.7g-1+squeeze9+deb6u13.diff.gz
 5acda7659b545c46706c9b4fff5b647bd84edc30 2103244 cacti_0.8.7g-1+squeeze9+deb6u13_all.deb
Checksums-Sha256: 
 eca202ea78a2a2091d21ec4cf319a975d74b7d84a4c4f3cd8af9976f3d1982e3 1804 cacti_0.8.7g-1+squeeze9+deb6u13.dsc
 d09b3bf54f51bd42b2db0a62521cf6e408716978f75d6509ec56027c49c44585 2236916 cacti_0.8.7g.orig.tar.gz
 bd241b2f55c8763f86181ffdd030294485539ec90b846fba7868efb772a9f251 74415 cacti_0.8.7g-1+squeeze9+deb6u13.diff.gz
 06dc316f3deac06429d5563fc6dc102ea4bd1ea973c9f978bf5e40e87f97cc0e 2103244 cacti_0.8.7g-1+squeeze9+deb6u13_all.deb
Files: 
 196e9b4a676e0f1a141de77b7d926b1d 1804 web extra cacti_0.8.7g-1+squeeze9+deb6u13.dsc
 268421cb1a58d3444f7ecbddb4c4b016 2236916 web extra cacti_0.8.7g.orig.tar.gz
 6554863c748a7110700c7d5f5da9ff1d 74415 web extra cacti_0.8.7g-1+squeeze9+deb6u13.diff.gz
 45da56084a03c03c70fef375b66edf0f 2103244 web extra cacti_0.8.7g-1+squeeze9+deb6u13_all.deb