Subject: [Pkg-cacti-maint] Bug#878304: cacti: CVE-2017-15194

From: Salvatore Bonaccorso <[email-masked]>
Date: Thu, 12 Oct 2017 16:22:20 +0200

Source: cacti
Version: 1.1.21+ds1-1
Severity: important
Tags: patch security upstream
Forwarded: https://github.com/Cacti/cacti/issues/1010

Hi,

the following vulnerability was published for cacti, just filling for
Debian BTS-documentation purposes.

CVE-2017-15194[0]:
| include/global_session.php in Cacti 1.1.25 has XSS related to (1) the
| URI or (2) the refresh page.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-15194
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15194
[1] https://github.com/Cacti/cacti/issues/1010
[2] https://github.com/Cacti/cacti/commit/93f661d8adcfa6618b11522cdab30e97bada33fd

Regards,
Salvatore

---

From: [email-masked] (Debian Bug Tracking System)
Date: Fri, 13 Oct 2017 19:57:03 +0000

Your message dated Fri, 13 Oct 2017 19:54:01 +0000
with message-id <[email-masked]>
and subject line Bug#878304: fixed in cacti 1.1.25+ds1-1
has caused the Debian Bug report #878304,
regarding cacti: CVE-2017-15194
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

-- 
878304: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=878304
Debian Bug Tracking System
Contact [email-masked] with problems

Subject: cacti: CVE-2017-15194
From: Salvatore Bonaccorso <[email-masked]>
To: Debian Bug Tracking System <[email-masked]>
Date: Thu, 12 Oct 2017 16:22:20 +0200

Source: cacti
Version: 1.1.21+ds1-1
Severity: important

Hi,

CVE-2017-15194[0]:

Regards,
Salvatore

Subject: Bug#878304: fixed in cacti 1.1.25+ds1-1
From: Paul Gevers <[email-masked]>
To: [email-masked]
Date: Fri, 13 Oct 2017 19:54:01 +0000

Source: cacti
Source-Version: 1.1.25+ds1-1

We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email-masked],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Gevers <[email-masked]> (supplier of updated cacti package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email-masked])

Format: 1.8
Date: Fri, 13 Oct 2017 21:09:04 +0200
Source: cacti
Binary: cacti
Architecture: source
Version: 1.1.25+ds1-1
Distribution: unstable
Urgency: medium
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Description:
 cacti      - web interface for graphing of monitoring systems
Closes: 878304
Changes:
 cacti (1.1.25+ds1-1) unstable; urgency=medium
 .
   * New upstream version 1.1.25
   * Improve the override_dh_fixperms target as some files were
     unintentionally missed and thus make cacti reproducible again
   * CVE-2017-15194: XSS in global_session.php
     - Add CVE-2017-15194.patch (Closes: #878304)
     - Add check to autopkgtest
Checksums-Sha1:
 067170de466a14cefc7d3b1c1ce443593b5c000e 2131 cacti_1.1.25+ds1-1.dsc
 0ee9c46aacb14248d3e8a3e9b2dff9a246e868b3 66892 cacti_1.1.25+ds1.orig-docs-source.tar.xz
 cf48f7285679d38565f1886ea502281acc40377b 3816491 cacti_1.1.25+ds1.orig.tar.gz
 9c517bd44c7c9e18ca602622239b9daf6e572242 50792 cacti_1.1.25+ds1-1.debian.tar.xz
Checksums-Sha256:
 1a9ceba1fc3534329d69ff33d15be086e9689f325bcb35c96ea1725b04b7d2ef 2131 cacti_1.1.25+ds1-1.dsc
 30931fb415c746524db2d752f8be47f568f7f4dc3ba0cc0a3f184c3951b337e9 66892 cacti_1.1.25+ds1.orig-docs-source.tar.xz
 83eb190928393883cf8c5c0ac75b84bc3e95ee57375d8f28076638c76e7f026f 3816491 cacti_1.1.25+ds1.orig.tar.gz
 bdfd02d069a023f1f0eab6e02fe234d5d7d22bad57c40a15639a6b6e0b9ebec9 50792 cacti_1.1.25+ds1-1.debian.tar.xz
Files:
 a33ac31674bc5e4c077e2f74eeadad97 2131 web extra cacti_1.1.25+ds1-1.dsc
 091493e53be845d24ac5bd061acf796f 66892 web extra cacti_1.1.25+ds1.orig-docs-source.tar.xz
 d5f8ed5cb181a6c77fc0d20e8d41a048 3816491 web extra cacti_1.1.25+ds1.orig.tar.gz
 63f58ffa89f47c7ca4a4115cb2458a4b 50792 web extra cacti_1.1.25+ds1-1.debian.tar.xz