Subject: [Pkg-cacti-maint] Bug#979998: cacti: CVE-2020-35701

From: Salvatore Bonaccorso <[email-masked]>
Date: Tue, 12 Jan 2021 19:07:46 +0100

Source: cacti
Version: 1.2.16+ds1-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/Cacti/cacti/issues/4022
X-Debbugs-Cc: [email-masked], Debian Security Team <[email-masked]>

Hi,

The following vulnerability was published for cacti.

CVE-2020-35701[0]:
| An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection
| vulnerability in data_debug.php allows remote authenticated attackers
| to execute arbitrary SQL commands via the site_id parameter. This can
| lead to remote code execution.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-35701
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35701
[1] https://github.com/Cacti/cacti/issues/4022

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

---

From: Paul Gevers <[email-masked]>
Date: Sun, 17 Jan 2021 19:46:43 +0100

found 979998 1.2.2+ds1-2+deb10u3
thanks

Hi Salvatore,

On 12-01-2021 19:07, Salvatore Bonaccorso wrote:

[...]

> The following vulnerability was published for cacti.

[...]

> Please adjust the affected versions in the BTS as needed.

Buster is affected. Does this warrant a security upload or should I
prepare a point release update?

Paul

---

From: "Debian Bug Tracking System" <[email-masked]>
Date: Sun, 17 Jan 2021 18:51:05 +0000

> found 979998 1.2.2+ds1-2+deb10u3
Bug #979998 [src:cacti] cacti: CVE-2020-35701
Marked as found in versions cacti/1.2.2+ds1-2+deb10u3.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
979998: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=979998
Debian Bug Tracking System
Contact [email-masked] with problems

---

From: "Debian Bug Tracking System" <[email-masked]>
Date: Sun, 17 Jan 2021 21:21:15 +0000

Your message dated Sun, 17 Jan 2021 21:18:58 +0000
with message-id <[email-masked]>
and subject line Bug#979998: fixed in cacti 1.2.16+ds1-2
has caused the Debian Bug report #979998,
regarding cacti: CVE-2020-35701
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

Subject: cacti: CVE-2020-35701
From: Salvatore Bonaccorso <[email-masked]>
To: Debian Bug Tracking System <[email-masked]>
Date: Tue, 12 Jan 2021 19:07:46 +0100

Source: cacti
Version: 1.2.16+ds1-1
Severity: important
Tags: security upstream

Hi,

CVE-2020-35701[0]:

Regards,
Salvatore

Subject: Bug#979998: fixed in cacti 1.2.16+ds1-2
From: Debian FTP Masters <[email-masked]>
To: [email-masked]
Date: Sun, 17 Jan 2021 21:18:58 +0000

Source: cacti
Source-Version: 1.2.16+ds1-2
Done: Paul Gevers <[email-masked]>

We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email-masked],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Gevers <[email-masked]> (supplier of updated cacti package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email-masked])

Format: 1.8
Date: Sun, 17 Jan 2021 21:26:01 +0100
Source: cacti
Architecture: source
Version: 1.2.16+ds1-2
Distribution: unstable
Urgency: medium
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Closes: 979998
Changes:
 cacti (1.2.16+ds1-2) unstable; urgency=medium
 .
   * Add 0001-Fixing-Issue-4022.patch (Closes: #979998)
     - CVE-2020-35701: SQL injection via data_debug.php
   * Add 0001-Fixing-Issue-4019.patch
     There are a few places in the current code where an attacker, once
     having gained access to the Cacti database through a SQL injection,
     could modify data in tables to possibly expose an stored XSS bug in
     Cacti.
Checksums-Sha1:
 876a9f1bcc8ddd6f48069b3263bd7de2f33352dd 2237 cacti_1.2.16+ds1-2.dsc
 f93bbcca5567c1196578939352dc17f0e63e15fd 56760 cacti_1.2.16+ds1-2.debian.tar.xz
Checksums-Sha256:
 f04c0e6982ed1194c865404d92bfa965a4d9370ed2bda977b7d082ac9036171f 2237 cacti_1.2.16+ds1-2.dsc
 4a63d4c0fd6e48571fc4b93659f61210c73959ad6fd1767fec39dc611d738782 56760 cacti_1.2.16+ds1-2.debian.tar.xz
Files:
 17457cbcc9f09003cd89ab571c30b704 2237 web optional cacti_1.2.16+ds1-2.dsc
 829232c329cdadd3606f9efcad2cbd4c 56760 web optional cacti_1.2.16+ds1-2.debian.tar.xz

---

From: "Debian Bug Tracking System" <[email-masked]>
Date: Sat, 23 Jan 2021 15:51:17 +0000

Your message dated Sat, 23 Jan 2021 15:47:07 +0000
with message-id <[email-masked]>
and subject line Bug#979998: fixed in cacti 1.2.2+ds1-2+deb10u4
has caused the Debian Bug report #979998,
regarding cacti: CVE-2020-35701
to be marked as done.

Source: cacti
Version: 1.2.16+ds1-1
Severity: important
Tags: security upstream

Hi,

CVE-2020-35701[0]:

Regards,
Salvatore

Subject: Bug#979998: fixed in cacti 1.2.2+ds1-2+deb10u4
From: Debian FTP Masters <[email-masked]>
To: [email-masked]
Date: Sat, 23 Jan 2021 15:47:07 +0000

Source: cacti
Source-Version: 1.2.2+ds1-2+deb10u4
Done: Paul Gevers <[email-masked]>

Format: 1.8
Date: Thu, 21 Jan 2021 20:16:38 +0100
Source: cacti
Architecture: source
Version: 1.2.2+ds1-2+deb10u4
Distribution: buster
Urgency: medium
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Closes: 979998
Changes:
 cacti (1.2.2+ds1-2+deb10u4) buster; urgency=medium
 .
   * Add 0001-Fixing-Issue-4022.patch (Closes: #979998)
     - CVE-2020-35701: SQL injection via data_debug.php
   * Add 0001-Fixing-Issue-4019.patch
     There are a few places in the current code where an attacker, once
     having gained access to the Cacti database through a SQL injection,
     could modify data in tables to possibly expose an stored XSS bug in
     Cacti.
Checksums-Sha1:
 f0651b1be15691e353695d67f8cfd818e22ab6be 2261 cacti_1.2.2+ds1-2+deb10u4.dsc
 dc06d18fa7c8dd6b75e77fe3f7ccbb88fb856fce 67920 cacti_1.2.2+ds1-2+deb10u4.debian.tar.xz
Checksums-Sha256:
 085ae645548b8a1cd6187dc725b7b0724e94b72fe5efb5de98726dfbf19a900f 2261 cacti_1.2.2+ds1-2+deb10u4.dsc
 36885c441acd4517f6ba52fb24e36803f89587ba7d26f01cc974691434d18d2a 67920 cacti_1.2.2+ds1-2+deb10u4.debian.tar.xz
Files:
 7e074c0bb8a23e0b2ad01311043933b5 2261 web optional cacti_1.2.2+ds1-2+deb10u4.dsc
 b3304f7f4acf7cb61f062dd9317d0909 67920 web optional cacti_1.2.2+ds1-2+deb10u4.debian.tar.xz