From captracicot at gmail.com  Sat Sep  7 12:04:06 2019
From: captracicot at gmail.com (JJ)
Date: Sat, 7 Sep 2019 11:04:06 +0000
Subject: [Pkg-cacti-maint] my reason
Message-ID: <CAAUcSWzeZq8Qmq-RkrdhjZ5d__xSqUJ3gfoFUOvGhA-7hssBMA@mail.gmail.com>

GoodMorning

The reason for this acquaintance is to actualize my fathers dream donation
funds, set-up for the Drug Rehabilitation center which was not Implemented
before he died.

Thank You
Jr and Joyce
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-cacti-maint/attachments/20190907/9385e2c6/attachment.html>

From ftpmaster at ftp-master.debian.org  Sun Sep  8 20:36:57 2019
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Sun, 08 Sep 2019 19:36:57 +0000
Subject: [Pkg-cacti-maint] Processing of cacti_1.2.6+ds1-1_source.changes
Message-ID: <E1i72zZ-0006Hy-JT@usper.debian.org>

cacti_1.2.6+ds1-1_source.changes uploaded successfully to localhost
along with the files:
  cacti_1.2.6+ds1-1.dsc
  cacti_1.2.6+ds1.orig-docs-source.tar.gz
  cacti_1.2.6+ds1.orig.tar.xz
  cacti_1.2.6+ds1-1.debian.tar.xz

Greetings,

	Your Debian queue daemon (running on host usper.debian.org)


From ftpmaster at ftp-master.debian.org  Sun Sep  8 21:37:18 2019
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Sun, 08 Sep 2019 20:37:18 +0000
Subject: [Pkg-cacti-maint] cacti_1.2.6+ds1-1_source.changes ACCEPTED into
 unstable
Message-ID: <E1i73vy-000GDc-JK@fasolo.debian.org>



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Thu, 05 Sep 2019 17:47:08 +0200
Source: cacti
Architecture: source
Version: 1.2.6+ds1-1
Distribution: unstable
Urgency: medium
Maintainer: Cacti Maintainer <pkg-cacti-maint at lists.alioth.debian.org>
Changed-By: Paul Gevers <elbrus at debian.org>
Changes:
 cacti (1.2.6+ds1-1) unstable; urgency=medium
 .
   * New upstream release 1.2.6
     - Refresh 07_cli-include-path.patch
   * Remove obsolete link to phpgettext
Checksums-Sha1:
 5b045d4e4284d8ddbbcf361c34101a5318bfeb26 2106 cacti_1.2.6+ds1-1.dsc
 6b94bece084d2bd603d04ee082f36e9991be1282 13510938 cacti_1.2.6+ds1.orig-docs-source.tar.gz
 69328dbb7c467a061a988013fdf4fde63adff825 3835152 cacti_1.2.6+ds1.orig.tar.xz
 04d5950b344795e262a3aa613a04decc7fe41a6a 53220 cacti_1.2.6+ds1-1.debian.tar.xz
Checksums-Sha256:
 79df3c37bf77bcb67f66bfd2382967c2fe4bd403ca321bccdbe7ad0cb5d1ddb7 2106 cacti_1.2.6+ds1-1.dsc
 44ffa224b706126ce508538ebda6d74fcb25ce7a03264fb4184b86366884c03e 13510938 cacti_1.2.6+ds1.orig-docs-source.tar.gz
 73fe064e41a707f8c81483ac804aeed3f2e334439909f629392fa92c16f0223b 3835152 cacti_1.2.6+ds1.orig.tar.xz
 c1d74094a1530c28091749a6882458cb9a2f234d3543cc8f8f21690d5b13f8b9 53220 cacti_1.2.6+ds1-1.debian.tar.xz
Files:
 e546eb9f7b8c10b49c5d22085964a89e 2106 web optional cacti_1.2.6+ds1-1.dsc
 a67e79fe9df66cb16c3ae6126b85b9d6 13510938 web optional cacti_1.2.6+ds1.orig-docs-source.tar.gz
 b3dc394af3f751b615b11af8fffd8b57 3835152 web optional cacti_1.2.6+ds1.orig.tar.xz
 9ca1db754bbcc92dfbf0756228d5cc14 53220 web optional cacti_1.2.6+ds1-1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEWLZtSHNr6TsFLeZynFyZ6wW9dQoFAl1xaT0ACgkQnFyZ6wW9
dQqe2wf/TWVsCQ/bbldRgoCsAsJuSbzZhCTeujSUjhq4ei6lyeN+ZJmUezwH2AvY
vLu1iIk7YRp2LhihXGEWTYczh7VvZaCDdWmvD90ZLBxFMXyYHXHeAJXBt5Kvkm+2
JBEJdque0zWbK9Kiycp34He2522NuAdx7vtp1F4iZu75GfQixqdiRrxFLExEpUMm
ezVhdOmOJ7a8jZIiI2DB60CCtdZeQejg0FrmgE+DIhehPtZ4/xRKtBWbV5vu/wQs
B2CtTQOoKiFrkN7ADeuOeQ2VcfzoEoWHBeAGXij23bV58Z/Irc3tFsIdXuK1JVo9
sLPY/kl5elcP3w2EV3Vgvn87jXngpg==
=S+K+
-----END PGP SIGNATURE-----


Thank you for your contribution to Debian.


From angelngx2 at gmail.com  Mon Sep  9 03:55:20 2019
From: angelngx2 at gmail.com (Angel NG)
Date: Mon, 9 Sep 2019 03:55:20 +0100
Subject: [Pkg-cacti-maint] Investment funds
Message-ID: <CA+2Lm8oek+P0tb4TiycO3r9DA8hsaUh6fVq-qj6pBfRGGOC+xw@mail.gmail.com>

Sir,

I am Mr. Angel Ng in Libya. I am interested in a joint partnership
venture with you or your company for a long time and i have One
Hundred And Fifty Million US Dollars ready for that.

Area of Investment interest are REAL ESTATE, AGRICULTURE, OIL SECTOR &
CONSTRUCTION, MINES AND ENERGY, ENTERTAINMENT, PHARMACEUTICAL, TOURISM
ETC.Source of funds: PROCEEDS FROM OIL & GAS e.t.c

If proposal is acceptable, we can set up a live meeting.
I will await your message.

Regards
Angel Ng
Email: a.angelng11 at gmail.com


From info at salecolmi.ru  Mon Sep  9 19:05:44 2019
From: info at salecolmi.ru (Aries Suwandi)
Date: Mon, 9 Sep 2019 21:05:44 +0300
Subject: [Pkg-cacti-maint] Service Procurement
Message-ID: <82nzrb0015287a1700fj67013ep920u8@getcourse.ru>

Hello

We are interested in purchasing your products and services and we sincerely hope to establish a long-term business relationship with your esteemed company.Please kindly send me your latest catalogue, contact us via: alialaraadi2031 at gmail.com.

Your early reply is highly appreciated.

Kind Regards.

Mr. Ali Abdullah Al-Araadi
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-cacti-maint/attachments/20190909/0a02585d/attachment.html>

From faxi at jcwindowfashions.com  Mon Sep  9 20:28:00 2019
From: faxi at jcwindowfashions.com (Jerry Edwards)
Date: Mon, 09 Sep 2019 21:28:00 +0200
Subject: [Pkg-cacti-maint] Quote needed
Message-ID: <201909091928.x89JRVej026192@www.gelogix.com>

Good day,
 Can you please assist me with quote for the below product.
 Lenovo Yoga C930 14" Intel� Core!22 i7-8550U (1.80GHz, up to 4.0GHz, Win 10,16GB DDR4 2400MHz,1TB SSD,UHD Graphics 620.
 Thank you for your assistance.
 Jerry Edwards
JC Window Fashions
6400 Fleet Street
Commerce, CA 90040
fax at jcwindowfashions.com
Ph 909 359 2526
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-cacti-maint/attachments/20190909/0116dae0/attachment.html>

From postmaster at vesc.ru  Wed Sep 11 07:36:03 2019
From: postmaster at vesc.ru (Ryan Jules)
Date: Wed, 11 Sep 2019 02:36:03 -0400
Subject: [Pkg-cacti-maint] Hi.
Message-ID: <auto-000000767799@vesc.ru>

I have been expecting to hear from you as regards to my previous message in view of Anderson's Estate and inheritance claims, I had a problem with my email so I am not sure if you got it. Send me an email: ryanj at danytylersolicitors-uk.com so I can give you further details on how to apply to the bank, this is very important. 

Best regards,
Ryan Jules.
Legal Practitioner/Solicitor.


From mrsallisonmiller at office.oops.jp  Thu Sep 12 13:05:19 2019
From: mrsallisonmiller at office.oops.jp (=?iso-2022-jp?B?TXJzIEFsbGlzb24gTWlsbGVy?=)
Date: 12 Sep 2019 21:05:19 +0900
Subject: [Pkg-cacti-maint] =?iso-8859-1?q?Hello_My_Dear?=
Message-ID: <20190912120519.19980.qmail@tools.lolipop.jp>

Hello My Dear,
With warm hearts I offer my friendship in the name of our lord God, I got your contact through this site and as well move into prayers on it. I have a brain tumor, I suffer terribly at the moment. My doctor just informed me that my days are numbered therefore condemned to certain death. Currently I do have some funds $4,860,000.000, for my charity project, these funds are deposited in a fixed deposit in a local bank. purposed for charitable foundation, so please if you could be trusted by our lord GOD immediately get back to me on my private Email: ( mrsallisonmiller at gmail.com ), for more information's.'
Send your reply to this my email address written below.
E-mail me to: mrsallisonmiller at gmail.com

Thanks and Remain blessed.


Mrs Allison Miller
My E-mail: mrsallisonmiller at gmail.com


From jeremiahmawuese004 at gmail.com  Fri Sep 13 13:15:00 2019
From: jeremiahmawuese004 at gmail.com (Austine Amaga)
Date: Fri, 13 Sep 2019 13:15:00 +0100
Subject: [Pkg-cacti-maint] =?utf-8?q?Gott_sch=C3=BCtze_dich=2E?=
Message-ID: <CA+LcoV1vq4e26=RRuUJR_NSo6VwLgZkqwiAsfAVzCNBCM=BN5g@mail.gmail.com>

Guten Tag,


Es tut mir leid, Sie in dieser Angelegenheit ohne Ihre vorherige
Zustimmung zu kontaktieren. Es war wegen der Dringlichkeit der Dinge.

Ich bin Auguste AMAGA, ein Rechtsanwalt, und der persönliche Anwalt
von  ein verstorbener Kunde aus Ihrem Land. Ich würde gerne wissen, ob
wir zusammenarbeiten können?

Seit dem Tod meines Mandanten ruht sein Fonds im Wert von 11,5
Millionen US-Dollar [elf Millionen und fünfhunderttausend Dollar] in
der Bank meines Landes. Die Bank hat mir eine Mitteilung gemacht, um
die nächsten Angehörigen für die Forderung der Fonds zu präsentieren,
andernfalls werden die Gelder beschlagnahmt.

Der Verstorbene starb bei einem Autounfall mit seiner ganzen Familie.
Ich habe mich mit Ihnen in Verbindung gesetzt, weil Sie den gleichen
Familiennamen wie der Verstorbene haben, deshalb, können Sie an die
Bank als mein verstorbener Kunde nächsten Angehörigen vorgestellt
werden. Mit meiner Unterstützung als der verstorbene persönliche
Anwalt, können Sie von der Bank genehmigt werden und das Geld wird
Ihnen freigegeben werden.

Ich freue mich auf Ihre Antwort, wenn Sie interessiert sind und ich
werde Ihnen weitere Details senden.

Mit freundlichen Grüßen,

Auguste Esq.


From fischerwolfgang311 at gmail.com  Wed Sep 18 10:14:58 2019
From: fischerwolfgang311 at gmail.com (Mrs. Halimah Musa)
Date: Wed, 18 Sep 2019 09:14:58 +0000
Subject: [Pkg-cacti-maint] Hello
Message-ID: <CAD0gtXaNeox1WhaXOupTGKqKTFjgdQD=H7KLbN6CVeFdg9AhTw@mail.gmail.com>

Hello Dear Friend I am Frank Yagazie; please I have a very important
issue to discuss with you. Please I urge you to write me ASAP.
Thank You,
Frank Yagazie.


From ftpmaster at ftp-master.debian.org  Thu Sep 19 12:46:26 2019
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Thu, 19 Sep 2019 11:46:26 +0000
Subject: [Pkg-cacti-maint] Processing of cacti_1.2.6+ds1-2_source.changes
Message-ID: <E1iAutG-0006Yq-Q5@usper.debian.org>

cacti_1.2.6+ds1-2_source.changes uploaded successfully to localhost
along with the files:
  cacti_1.2.6+ds1-2.dsc
  cacti_1.2.6+ds1-2.debian.tar.xz

Greetings,

	Your Debian queue daemon (running on host usper.debian.org)


From ftpmaster at ftp-master.debian.org  Thu Sep 19 13:04:08 2019
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Thu, 19 Sep 2019 12:04:08 +0000
Subject: [Pkg-cacti-maint] cacti_1.2.6+ds1-2_source.changes ACCEPTED into
 unstable
Message-ID: <E1iAvAO-0003P0-HO@fasolo.debian.org>



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Tue, 17 Sep 2019 20:31:04 +0200
Source: cacti
Architecture: source
Version: 1.2.6+ds1-2
Distribution: unstable
Urgency: medium
Maintainer: Cacti Maintainer <pkg-cacti-maint at lists.alioth.debian.org>
Changed-By: Paul Gevers <elbrus at debian.org>
Closes: 934898
Changes:
 cacti (1.2.6+ds1-2) unstable; urgency=medium
 .
   [ Paul Gevers]
   * Fix autopkgtest regression with 0001-Resolving-Issue-2899.patch from
     upstream
   * Apache skipped the php section in apache.conf since PHP 7 (Closes:
     #934898)
   * Translations were broken since 1.2.4+ds1-1. Import upstream solution
     enabling the use of php-phpmyadmin-motranslator.
 .
   [ Rafael David Tinoco ]
   * Prepare sql commands for MySQL 8 (See: #933683)
Checksums-Sha1:
 45a7ca87931f89fd779dc1915819e62c44e4ab5e 2106 cacti_1.2.6+ds1-2.dsc
 57bc5939cd475c34c25a32e0775992bbed9b9653 58044 cacti_1.2.6+ds1-2.debian.tar.xz
Checksums-Sha256:
 4cced6565c60293ef6e6a8efafdef9802f2f6803506c7098abb698c45043dbfa 2106 cacti_1.2.6+ds1-2.dsc
 0011c0afecee14506c01e222a103f13ab7828d0ce63f9ecbe19dacf20f1f8e10 58044 cacti_1.2.6+ds1-2.debian.tar.xz
Files:
 7412178d6359328d54b62d5ed196517f 2106 web optional cacti_1.2.6+ds1-2.dsc
 44ef4db2837e89baab772bd1eb3e64a2 58044 web optional cacti_1.2.6+ds1-2.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEWLZtSHNr6TsFLeZynFyZ6wW9dQoFAl2DaOYACgkQnFyZ6wW9
dQrWLAgAliM7GUntWXHsbxEGIRIaaOloZbsiyJaYvnaKLUdHdHfmlnlqce6oAdJU
61omvHZA1zWiFspCENz7TuzeIGbl5oyJOFtkTKBhmjIwMzbDYpn+1Hx2LbIJKZxR
Q9ne5hk1OLDNJLchllRtqZMW/RCZftH5uGS2fX44er8kOlm/JMG9ihbJftE6kcGW
LbhQ+WyKx04CraOqv9iaQZet5jVlAqy1TnDjMyp+7q/m0pPHARIp8x8f6B6QkdhG
unFidWFrffUoxEswNbVMoSRPLTL7pmrjN+F9/kmW1yKpOrrDUzFCifBZ74WEjlAR
AHIg8/HhFWufPrwq21SzyMIleOcVHQ==
=pJ9M
-----END PGP SIGNATURE-----


Thank you for your contribution to Debian.


From owner at bugs.debian.org  Thu Sep 19 13:06:06 2019
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Thu, 19 Sep 2019 12:06:06 +0000
Subject: [Pkg-cacti-maint] Bug#934898: marked as done (cacti: php
 configuration via apache config file is not enabled with php7.3 in buster
 and newer.)
References: <E1iAvAO-0003P8-Jy@fasolo.debian.org>
 <667c4b5f-0a43-dd2e-a276-fdb9752b814b@aasen.cx>
Message-ID: <handler.934898.D934898.15688946508396.ackdone@bugs.debian.org>

Your message dated Thu, 19 Sep 2019 12:04:08 +0000
with message-id <E1iAvAO-0003P8-Jy at fasolo.debian.org>
and subject line Bug#934898: fixed in cacti 1.2.6+ds1-2
has caused the Debian Bug report #934898,
regarding cacti: php configuration via apache config file is not enabled with php7.3 in buster and newer.
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner at bugs.debian.org
immediately.)


-- 
934898: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934898
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems
-------------- next part --------------
An embedded message was scrubbed...
From: Ronny Aasen <ronny at aasen.cx>
Subject: cacti: php configuration via apache config file is not enabled with php7.3 in buster and newer.
Date: Fri, 16 Aug 2019 11:22:00 +0200
Size: 6307
URL: <http://alioth-lists.debian.net/pipermail/pkg-cacti-maint/attachments/20190919/ec31dc88/attachment.mht>
-------------- next part --------------
An embedded message was scrubbed...
From: Paul Gevers <elbrus at debian.org>
Subject: Bug#934898: fixed in cacti 1.2.6+ds1-2
Date: Thu, 19 Sep 2019 12:04:08 +0000
Size: 4774
URL: <http://alioth-lists.debian.net/pipermail/pkg-cacti-maint/attachments/20190919/ec31dc88/attachment-0001.mht>

From juleslebon550 at gmail.com  Sun Sep 22 00:03:07 2019
From: juleslebon550 at gmail.com (Mr, Robert)
Date: Sun, 22 Sep 2019 01:03:07 +0200
Subject: [Pkg-cacti-maint] 
 =?utf-8?b?Vm91cyDDqnRlcyBiw6luw6lmaWNpYWlyZSBk?=
 =?utf-8?q?e_1=2E425=2E000_EUROS?=
Message-ID: <CAHP-c8tA2AWxR--uqi+WH5cJ-_R6V9oF8i09Z4cWecS0Suw1iQ@mail.gmail.com>

*Mes salutations,  Je me présente Monsieur Robert SONNE, je vous écris
aujourd'hui pour vous inviter dans mon projet de charité et je serai prêt à
faire un don d'argent pour vous de poursuivre le projet dans votre pays. Je
vais vous donner de plus amples informations sur votre réponse, je vous
prie de bien vouloir me contacter à mon adresse émail personnel :
robertsonne at orange.fr <robertsonne at orange.fr> Que le Seigneur Dieu créateur
du ciel et de la terre exauce vos prières, Amen!!!*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-cacti-maint/attachments/20190922/360beab8/attachment.html>

From abible at inetz.com  Mon Sep 23 19:18:46 2019
From: abible at inetz.com (Anthony Bible)
Date: Mon, 23 Sep 2019 12:18:46 -0600
Subject: [Pkg-cacti-maint] Bug#929323: cacti-spine: results_buffer size
 limits reporting capabilities
In-Reply-To: <a705691c-b762-356b-a03b-851b3798c91b@debian.org>
References: <155845455978.26540.13609558344138102927.reportbug@mon1.inetz.com>
 <a705691c-b762-356b-a03b-851b3798c91b@debian.org>
 <155845455978.26540.13609558344138102927.reportbug@mon1.inetz.com>
Message-ID: <98769a3a-b196-86d6-e4dc-0e8888d499c0@inetz.com>

Paul,
I've noticed the upstream included a fix
(https://github.com/Cacti/spine/issues/94) and was wondering if you
might release this fix?

On 5/23/19 12:23 PM, Paul Gevers wrote:
> Control: forwarded -1 https://github.com/Cacti/spine/issues/94
>
> Hi Anthony
>
> On 21-05-2019 18:02, Anthony Bible wrote:
>> We have several services being checked that return more than 1024
>> bytes (with_resluts_buffer limit of cacti-spine). This makes it so
>> information doesn't get catalouged by cacti.
> Thanks for your report. I have forwarded it to the upstream issue tracker.
>
> Paul
>
-- 
Anthony Bible

Inetz Jr. Systems Administrator


From ftpmaster at ftp-master.debian.org  Mon Sep 23 20:49:28 2019
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Mon, 23 Sep 2019 19:49:28 +0000
Subject: [Pkg-cacti-maint] Processing of cacti-spine_1.2.6-1_source.changes
Message-ID: <E1iCUKu-0001Kl-JA@usper.debian.org>

cacti-spine_1.2.6-1_source.changes uploaded successfully to localhost
along with the files:
  cacti-spine_1.2.6-1.dsc
  cacti-spine_1.2.6.orig.tar.gz
  cacti-spine_1.2.6-1.debian.tar.xz

Greetings,

	Your Debian queue daemon (running on host usper.debian.org)


From carnil at debian.org  Mon Sep 23 21:20:27 2019
From: carnil at debian.org (Salvatore Bonaccorso)
Date: Mon, 23 Sep 2019 22:20:27 +0200
Subject: [Pkg-cacti-maint] Bug#941036: cacti: CVE-2019-16723
Message-ID: <156927002778.23260.16405372379267727798.reportbug@eldamar.local>

Source: cacti
Version: 1.2.6+ds1-2
Severity: important
Tags: security upstream
Forwarded: https://github.com/Cacti/cacti/issues/2964

Hi,

The following vulnerability was published for cacti, filling for
tracking the upstream issue. At time of writing, I think there was not
a patch upstream yet.

CVE-2019-16723[0]:
| In Cacti through 1.2.6, authenticated users may bypass authorization
| checks (for viewing a graph) via a direct graph_json.php request with
| a modified local_graph_id parameter.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-16723
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16723
[1] https://github.com/Cacti/cacti/issues/2964

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore


From elbrus at debian.org  Mon Sep 23 21:28:31 2019
From: elbrus at debian.org (Paul Gevers)
Date: Mon, 23 Sep 2019 22:28:31 +0200
Subject: [Pkg-cacti-maint] Bug#941036: cacti: CVE-2019-16723
In-Reply-To: <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
References: <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
 <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
Message-ID: <e0d70f27-32be-ab6d-7a77-e74d0d7e86da@debian.org>

Hi Salvatore,

Thanks for your report.

On 23-09-2019 22:20, Salvatore Bonaccorso wrote:
> The following vulnerability was published for cacti, filling for
> tracking the upstream issue. At time of writing, I think there was not
> a patch upstream yet.

I think there is:
https://github.com/Cacti/cacti/commit/7a6a17252a1cbda180b61fff244cb3ce797d5264

It mentioned the wrong issue, as documented here:
https://github.com/Cacti/cacti/commit/de3833b0414383efc9e075dd13c95925e2ca504c

Paul

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-cacti-maint/attachments/20190923/f499f07b/attachment.sig>

From ftpmaster at ftp-master.debian.org  Mon Sep 23 21:37:56 2019
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Mon, 23 Sep 2019 20:37:56 +0000
Subject: [Pkg-cacti-maint] cacti-spine_1.2.6-1_source.changes ACCEPTED into
 unstable
Message-ID: <E1iCV5o-0003IH-3N@fasolo.debian.org>



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Mon, 23 Sep 2019 20:37:59 +0200
Source: cacti-spine
Architecture: source
Version: 1.2.6-1
Distribution: unstable
Urgency: medium
Maintainer: Cacti Maintainer <pkg-cacti-maint at lists.alioth.debian.org>
Changed-By: Paul Gevers <elbrus at debian.org>
Closes: 929323
Changes:
 cacti-spine (1.2.6-1) unstable; urgency=medium
 .
   * New upstream version 1.2.6
     - Increase default 'results_buffer' size to 2048 (Closes: #929323)
   * Update d/copyright
   * Bump debhelper compat level via BD on debhelper-compat
   * Bump standards
Checksums-Sha1:
 7d4a5866969cb09f2674aab6be7f4781ce3676e1 1805 cacti-spine_1.2.6-1.dsc
 1ec470199edc2bf9307e266be9bbf818d11a77ee 106592 cacti-spine_1.2.6.orig.tar.gz
 21fa0629b55ed41004b119231a8c65c7fb256ffe 14488 cacti-spine_1.2.6-1.debian.tar.xz
Checksums-Sha256:
 4ede7736296ec72a405aa4546f63ff8cd80398005477dc1100c3d46c9609ddfd 1805 cacti-spine_1.2.6-1.dsc
 e7f9403cf185d1bed10b53d8ef61322f9ad4af9ec67021d154e47f85da99af62 106592 cacti-spine_1.2.6.orig.tar.gz
 bfab10e8f757d4056c2b38f9b400d28642f4c293e11b542044445062f2fd12c6 14488 cacti-spine_1.2.6-1.debian.tar.xz
Files:
 0309be45b1db0f7de1bc25dd483bfabd 1805 web optional cacti-spine_1.2.6-1.dsc
 ba3e8723fa9b8f0b5db6dddb03b33a17 106592 web optional cacti-spine_1.2.6.orig.tar.gz
 4c99d8c62052e0afca66bb7608662615 14488 web optional cacti-spine_1.2.6-1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEWLZtSHNr6TsFLeZynFyZ6wW9dQoFAl2JHtYACgkQnFyZ6wW9
dQqQsQgAoE/nQIFLHFDNvcZSiDABfp9iRMv1DucKA5flLYnmpJ4exNNzPPNpZB6G
mG2qbPwwEjkvldfdB68rMiNt5Q9w+9/8yPePUhXTen29rEAhW83oEqV7PXHpVaS/
reMjjIip9GTeCLZqL5x90w4H6fD73xqtXjGlvxaBaGrBNNjfnggzv019yKUHvDxk
gKSjrF4Gnhpa5EX1/a8VvxvgVT5K+26wcMgSNN6QyO//SeVViFAUwn9bNY/8umgb
K8eT/4m3I2fBz7amCOBpvqWIoBCh6DFLTX/CfE30lB1Pp0kGBLzGXLz3RreITMnF
AaRMr55U6mUsp+J9Jl4+0cLjFyaH7g==
=vXeN
-----END PGP SIGNATURE-----


Thank you for your contribution to Debian.


From owner at bugs.debian.org  Mon Sep 23 21:39:04 2019
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Mon, 23 Sep 2019 20:39:04 +0000
Subject: [Pkg-cacti-maint] Bug#929323: marked as done (cacti-spine:
 results_buffer size limits reporting capabilities)
References: <E1iCV5o-0003IP-53@fasolo.debian.org>
 <155845455978.26540.13609558344138102927.reportbug@mon1.inetz.com>
Message-ID: <handler.929323.D929323.156927107922053.ackdone@bugs.debian.org>

Your message dated Mon, 23 Sep 2019 20:37:56 +0000
with message-id <E1iCV5o-0003IP-53 at fasolo.debian.org>
and subject line Bug#929323: fixed in cacti-spine 1.2.6-1
has caused the Debian Bug report #929323,
regarding cacti-spine: results_buffer size limits reporting capabilities
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner at bugs.debian.org
immediately.)


-- 
929323: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929323
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems
-------------- next part --------------
An embedded message was scrubbed...
From: Anthony Bible <abible at inetz.com>
Subject: cacti-spine: results_buffer size limits reporting capabilities
Date: Tue, 21 May 2019 10:02:39 -0600
Size: 3634
URL: <http://alioth-lists.debian.net/pipermail/pkg-cacti-maint/attachments/20190923/d10e20b8/attachment-0002.mht>
-------------- next part --------------
An embedded message was scrubbed...
From: Paul Gevers <elbrus at debian.org>
Subject: Bug#929323: fixed in cacti-spine 1.2.6-1
Date: Mon, 23 Sep 2019 20:37:56 +0000
Size: 4889
URL: <http://alioth-lists.debian.net/pipermail/pkg-cacti-maint/attachments/20190923/d10e20b8/attachment-0003.mht>

From testlink at simartis.ro  Tue Sep 24 01:05:58 2019
From: testlink at simartis.ro (testlink at simartis.ro)
Date: Mon, 23 Sep 2019 14:05:58 -1000
Subject: [Pkg-cacti-maint] Offer
Message-ID: <mailman.232.1569283613.635.pkg-cacti-maint@alioth-lists.debian.net>

Are you desperately in need of a Business or personal loans? We offer all kinds of loans at1% rate, contact us today at Email: randlebrooks2000 at gmail.com Whatsapp:+12676685789
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-cacti-maint/attachments/20190923/9ecfd9fe/attachment.html>

From carnil at debian.org  Tue Sep 24 04:58:19 2019
From: carnil at debian.org (Salvatore Bonaccorso)
Date: Tue, 24 Sep 2019 05:58:19 +0200
Subject: [Pkg-cacti-maint] Bug#941036: cacti: CVE-2019-16723
In-Reply-To: <e0d70f27-32be-ab6d-7a77-e74d0d7e86da@debian.org>
References: <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
 <e0d70f27-32be-ab6d-7a77-e74d0d7e86da@debian.org>
 <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
Message-ID: <20190924035819.GA19667@lorien.valinor.li>

Hi Paul,

On Mon, Sep 23, 2019 at 10:28:31PM +0200, Paul Gevers wrote:
> Hi Salvatore,
> 
> Thanks for your report.
> 
> On 23-09-2019 22:20, Salvatore Bonaccorso wrote:
> > The following vulnerability was published for cacti, filling for
> > tracking the upstream issue. At time of writing, I think there was not
> > a patch upstream yet.
> 
> I think there is:
> https://github.com/Cacti/cacti/commit/7a6a17252a1cbda180b61fff244cb3ce797d5264
> 
> It mentioned the wrong issue, as documented here:
> https://github.com/Cacti/cacti/commit/de3833b0414383efc9e075dd13c95925e2ca504c

"Ack", thank you!

Regards,
Salvatore


From info at carlsondentalgroups.com  Tue Sep 24 19:18:40 2019
From: info at carlsondentalgroups.com (David Cambel)
Date: Tue, 24 Sep 2019 20:18:40 +0200
Subject: [Pkg-cacti-maint] Quotation request
Message-ID: <201909241819.x8OIHufA003154@www.gelogix.com>

The Sales Department,
  Please provide us with quotation for HP Laser Toner Cartridges as listed below:
 (6) HP 651A Black Original LaserJet Toner Cartridge, CE340A
(6) HP 651A Cyan Original LaserJet Toner Cartridge, CE341A
(6) HP 651A Yellow Original LaserJet Toner Cartridge, CE342A
(6) HP 651A Magenta Original LaserJet Toner Cartridge, CE343A
 All quoted items must be HP OEM Cartridges. If you have any question please email me on info at carlsondentalgroups.com
 Thank you.
 David Cambel
Carlson Dental Group
13241 Bartram Park Blvd #1700
Jacksonville, FL 32258
Tel: 904 289 1509
www.carlsondentalgroup.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-cacti-maint/attachments/20190924/8352566a/attachment.html>

From elbrus at debian.org  Tue Sep 24 19:43:46 2019
From: elbrus at debian.org (Paul Gevers)
Date: Tue, 24 Sep 2019 20:43:46 +0200
Subject: [Pkg-cacti-maint] Bug#941036: cacti: CVE-2019-16723
In-Reply-To: <20190924035819.GA19667@lorien.valinor.li>
References: <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
 <e0d70f27-32be-ab6d-7a77-e74d0d7e86da@debian.org>
 <20190924035819.GA19667@lorien.valinor.li>
 <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
Message-ID: <ff8adea7-d783-edf8-192f-9d555c58f91d@debian.org>

Hi,

On 24-09-2019 05:58, Salvatore Bonaccorso wrote:
> Hi Paul,
> 
> On Mon, Sep 23, 2019 at 10:28:31PM +0200, Paul Gevers wrote:
>> Hi Salvatore,
>>
>> Thanks for your report.
>>
>> On 23-09-2019 22:20, Salvatore Bonaccorso wrote:
>>> The following vulnerability was published for cacti, filling for
>>> tracking the upstream issue. At time of writing, I think there was not
>>> a patch upstream yet.
>>
>> I think there is:
>> https://github.com/Cacti/cacti/commit/7a6a17252a1cbda180b61fff244cb3ce797d5264
>>
>> It mentioned the wrong issue, as documented here:
>> https://github.com/Cacti/cacti/commit/de3833b0414383efc9e075dd13c95925e2ca504c
> 
> "Ack", thank you!
> 
> Regards,
> Salvatore
> 

While trying to figure out if old-stable is affected, I noticed this is
part of the fix:
https://github.com/Cacti/cacti/commit/c7cf4a26e4848872b48094e67f8d0a01dd7613d2

Paul

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-cacti-maint/attachments/20190924/27719e0b/attachment.sig>

From carnil at debian.org  Tue Sep 24 19:55:54 2019
From: carnil at debian.org (Salvatore Bonaccorso)
Date: Tue, 24 Sep 2019 20:55:54 +0200
Subject: [Pkg-cacti-maint] Bug#941036: cacti: CVE-2019-16723
In-Reply-To: <ff8adea7-d783-edf8-192f-9d555c58f91d@debian.org>
References: <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
 <e0d70f27-32be-ab6d-7a77-e74d0d7e86da@debian.org>
 <20190924035819.GA19667@lorien.valinor.li>
 <ff8adea7-d783-edf8-192f-9d555c58f91d@debian.org>
 <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
Message-ID: <20190924185554.GA3814@eldamar.local>

Hi,

On Tue, Sep 24, 2019 at 08:43:46PM +0200, Paul Gevers wrote:
> Hi,
> 
> On 24-09-2019 05:58, Salvatore Bonaccorso wrote:
> > Hi Paul,
> > 
> > On Mon, Sep 23, 2019 at 10:28:31PM +0200, Paul Gevers wrote:
> >> Hi Salvatore,
> >>
> >> Thanks for your report.
> >>
> >> On 23-09-2019 22:20, Salvatore Bonaccorso wrote:
> >>> The following vulnerability was published for cacti, filling for
> >>> tracking the upstream issue. At time of writing, I think there was not
> >>> a patch upstream yet.
> >>
> >> I think there is:
> >> https://github.com/Cacti/cacti/commit/7a6a17252a1cbda180b61fff244cb3ce797d5264
> >>
> >> It mentioned the wrong issue, as documented here:
> >> https://github.com/Cacti/cacti/commit/de3833b0414383efc9e075dd13c95925e2ca504c
> > 
> > "Ack", thank you!
> > 
> > Regards,
> > Salvatore
> > 
> 
> While trying to figure out if old-stable is affected, I noticed this is
> part of the fix:
> https://github.com/Cacti/cacti/commit/c7cf4a26e4848872b48094e67f8d0a01dd7613d2

Added this as well as further reference for the CVE!

Regards,
Salvatore


From elbrus at debian.org  Tue Sep 24 20:02:58 2019
From: elbrus at debian.org (Paul Gevers)
Date: Tue, 24 Sep 2019 21:02:58 +0200
Subject: [Pkg-cacti-maint] Bug#941036: cacti: CVE-2019-16723
In-Reply-To: <ff8adea7-d783-edf8-192f-9d555c58f91d@debian.org>
References: <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
 <e0d70f27-32be-ab6d-7a77-e74d0d7e86da@debian.org>
 <20190924035819.GA19667@lorien.valinor.li>
 <ff8adea7-d783-edf8-192f-9d555c58f91d@debian.org>
 <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
Message-ID: <32fe872e-b53b-5ebe-5414-f802b81db5f3@debian.org>

Hi,

Although not 100% sure yet, I seriously doubt that old stable is
affected as version 1.0.0 has this:

-feature: New Graph Permissions system designed to make permissions
simple to manage

So I believe the affected code was only introduced then.

Paul

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-cacti-maint/attachments/20190924/f51bb80f/attachment-0001.sig>

From camie.dupuis at uclouvain.be  Fri Sep 27 20:37:04 2019
From: camie.dupuis at uclouvain.be (DUPUIS Camie)
Date: Fri, 27 Sep 2019 19:37:04 +0000
Subject: [Pkg-cacti-maint] [STLUC-SPAM]: $2,000,000.00 USD
Message-ID: <B603E1C82840F44CA84F3478DD9437EB015072EA@EXCHANGE-SRV01.stluc.ucl.ac.be>



$2,000,000.00 USD Donated to you. REPLY To  azimhashimpremji.fd at gmail.com<https://www.google.com/url?q=https%3A%2F%2Fderef-mail.com%2Fmail%2Fclient%2FSjmbJ678DUo%2Fdereferrer%2F%3FredirectUrl%3Dhttps%253A%252F%252Fmail.google.com%252Fmail%252Fu%252F5%252Fh%252Fr4ipaqbjqtts%252F%253F%2526cs%253Dwh%2526v%253Db%2526to%253Dazimhashimpremji.fd%2540gmail.com&sa=D&sntz=1&usg=AFQjCNG1wnnHycU4q1PD5twR3xyPuWFPFQ>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-cacti-maint/attachments/20190927/b9fde8d1/attachment.html>

From ftpmaster at ftp-master.debian.org  Sat Sep 28 10:11:12 2019
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Sat, 28 Sep 2019 09:11:12 +0000
Subject: [Pkg-cacti-maint] Processing of cacti_1.2.6+ds1-3_source.changes
Message-ID: <E1iE8ky-0000ry-1W@usper.debian.org>

cacti_1.2.6+ds1-3_source.changes uploaded successfully to localhost
along with the files:
  cacti_1.2.6+ds1-3.dsc
  cacti_1.2.6+ds1-3.debian.tar.xz

Greetings,

	Your Debian queue daemon (running on host usper.debian.org)


From ftpmaster at ftp-master.debian.org  Sat Sep 28 10:19:23 2019
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Sat, 28 Sep 2019 09:19:23 +0000
Subject: [Pkg-cacti-maint] cacti_1.2.6+ds1-3_source.changes ACCEPTED into
 unstable
Message-ID: <E1iE8st-000FBk-Pz@fasolo.debian.org>



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sat, 28 Sep 2019 10:49:29 +0200
Source: cacti
Architecture: source
Version: 1.2.6+ds1-3
Distribution: unstable
Urgency: medium
Maintainer: Cacti Maintainer <pkg-cacti-maint at lists.alioth.debian.org>
Changed-By: Paul Gevers <elbrus at debian.org>
Changes:
 cacti (1.2.6+ds1-3) unstable; urgency=medium
 .
   * Add 0001-Resolving-Issue-2984.patch to fix CI error
Checksums-Sha1:
 3fa3866657d02e6cc1c7574b8a5205e8715e2fd4 2106 cacti_1.2.6+ds1-3.dsc
 33f7e4f02e327f452635e91705ccffa7358ce9a1 58212 cacti_1.2.6+ds1-3.debian.tar.xz
Checksums-Sha256:
 a7626e4a14fff31756539540fd52957311d754b0d99a37b639ce355177c586a5 2106 cacti_1.2.6+ds1-3.dsc
 c20d663fda9c1d9bf16429a12b94278f9449c6fc2f70051624ead3f885c22b29 58212 cacti_1.2.6+ds1-3.debian.tar.xz
Files:
 b259014055f65b4890520e741a39e05b 2106 web optional cacti_1.2.6+ds1-3.dsc
 28dfa3437baf379822dda706d37d02e5 58212 web optional cacti_1.2.6+ds1-3.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQEyBAEBCAAdFiEEWLZtSHNr6TsFLeZynFyZ6wW9dQoFAl2PIQ8ACgkQnFyZ6wW9
dQokiAf47CIk38EZhYjbhc8bjywD5s0ZevzCbLM4iHU7j93veukPKht0mI7DlWKK
2v9136tX6ujGw8gA3trBG1YxkcAjlNn/2lknDq5EilvlgG3X1kQAwuqSh1riOBQg
lZguMq5T7GZN14nUw22AYXwhlAkB7VpNWDQd2iJ9yQjyGyQ0kVBha9tgSeOxXs/7
GpVocj59NdCbHS2+5/mRo/yxne2yxFiZxZLDjCO1+vAcJUN7jeX2grBwqnYv7KK+
2PHpqg2VArND0ev41cgchgkUGVJ3JvxmqPjhlJQ7CTy4N2R+yrAI7omN7uORKLZL
O/93mWRSyF7NilFHWl9QCbeose05
=sVWu
-----END PGP SIGNATURE-----


Thank you for your contribution to Debian.


From carnil at debian.org  Sat Sep 28 22:41:37 2019
From: carnil at debian.org (Salvatore Bonaccorso)
Date: Sat, 28 Sep 2019 23:41:37 +0200
Subject: [Pkg-cacti-maint] Bug#941036: cacti: CVE-2019-16723
In-Reply-To: <32fe872e-b53b-5ebe-5414-f802b81db5f3@debian.org>
References: <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
 <e0d70f27-32be-ab6d-7a77-e74d0d7e86da@debian.org>
 <20190924035819.GA19667@lorien.valinor.li>
 <ff8adea7-d783-edf8-192f-9d555c58f91d@debian.org>
 <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
 <32fe872e-b53b-5ebe-5414-f802b81db5f3@debian.org>
 <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
Message-ID: <20190928214137.GA8601@eldamar.local>

Hi Paul,

On Tue, Sep 24, 2019 at 09:02:58PM +0200, Paul Gevers wrote:
> Hi,
> 
> Although not 100% sure yet, I seriously doubt that old stable is
> affected as version 1.0.0 has this:
> 
> -feature: New Graph Permissions system designed to make permissions
> simple to manage
> 
> So I believe the affected code was only introduced then.

I tried to get an idea here, but still I'm not sure 100%. Isn't for
instance the is_graph_allowed check missing in e.g. graph_xport.php,
so before accessing the graph_info, there is no check for if the user
is allowed to access the graph. For other parts this is done in
0.8.8h.

When in doupt, I rather would prefer to "wrongly" mark something as
affected rather than triage it as not-affected, and later to be turned
wrong.

Although the CVE assignment is somehow specific to the graph_json.php
part, which is not present in 0.8.8h I'm raising still the above, as
upstream has at least decided to cover the other changes for
permission checks in the two related commits.

Is upstream available to check and to confirm the stretch version is
not affected despite the potential missing permission checks there?

Regards,
Salvatore


From noreply at release.debian.org  Sun Sep 29 05:39:10 2019
From: noreply at release.debian.org (Debian testing watch)
Date: Sun, 29 Sep 2019 04:39:10 +0000
Subject: [Pkg-cacti-maint] cacti-spine 1.2.6-1 MIGRATED to testing
Message-ID: <E1iEQzG-00013y-8A@respighi.debian.org>

FYI: The status of the cacti-spine source package
in Debian's testing distribution has changed.

  Previous version: 1.2.2-1
  Current version:  1.2.6-1

-- 
This email is automatically generated once a day.  As the installation of
new packages into testing happens multiple times a day you will receive
later changes on the next day.
See https://release.debian.org/testing-watch/ for more information.


From elbrus at debian.org  Sat Sep 28 22:03:48 2019
From: elbrus at debian.org (Paul Gevers)
Date: Sat, 28 Sep 2019 23:03:48 +0200
Subject: [Pkg-cacti-maint] Bug#941036: cacti: CVE-2019-16723
In-Reply-To: <20190928214137.GA8601@eldamar.local>
References: <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
 <e0d70f27-32be-ab6d-7a77-e74d0d7e86da@debian.org>
 <20190924035819.GA19667@lorien.valinor.li>
 <ff8adea7-d783-edf8-192f-9d555c58f91d@debian.org>
 <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
 <32fe872e-b53b-5ebe-5414-f802b81db5f3@debian.org>
 <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
 <20190928214137.GA8601@eldamar.local>
 <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
Message-ID: <386decde-2f6b-8f2e-d1bd-47cb9c4a428f@debian.org>

Hi Salvatore,

On 28-09-2019 23:41, Salvatore Bonaccorso wrote:
>> So I believe the affected code was only introduced then.
> 
> I tried to get an idea here, but still I'm not sure 100%. Isn't for
> instance the is_graph_allowed check missing in e.g. graph_xport.php,
> so before accessing the graph_info, there is no check for if the user
> is allowed to access the graph. For other parts this is done in
> 0.8.8h.
> 
> When in doupt, I rather would prefer to "wrongly" mark something as
> affected rather than triage it as not-affected, and later to be turned
> wrong.
> 
> Although the CVE assignment is somehow specific to the graph_json.php
> part, which is not present in 0.8.8h I'm raising still the above, as
> upstream has at least decided to cover the other changes for
> permission checks in the two related commits.
> 
> Is upstream available to check and to confirm the stretch version is
> not affected despite the potential missing permission checks there?

I already noted on IRC the other day that I think the pre 1 code is
affected as well. So I agree with your assessment.

Paul

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-cacti-maint/attachments/20190928/5cc2d3bd/attachment.sig>

From carnil at debian.org  Sun Sep 29 07:45:40 2019
From: carnil at debian.org (Salvatore Bonaccorso)
Date: Sun, 29 Sep 2019 08:45:40 +0200
Subject: [Pkg-cacti-maint] Bug#941036: cacti: CVE-2019-16723
In-Reply-To: <386decde-2f6b-8f2e-d1bd-47cb9c4a428f@debian.org>
References: <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
 <e0d70f27-32be-ab6d-7a77-e74d0d7e86da@debian.org>
 <20190924035819.GA19667@lorien.valinor.li>
 <ff8adea7-d783-edf8-192f-9d555c58f91d@debian.org>
 <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
 <32fe872e-b53b-5ebe-5414-f802b81db5f3@debian.org>
 <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
 <20190928214137.GA8601@eldamar.local>
 <386decde-2f6b-8f2e-d1bd-47cb9c4a428f@debian.org>
 <156927002778.23260.16405372379267727798.reportbug@eldamar.local>
Message-ID: <20190929064540.GA16371@eldamar.local>

Hi Paul,

On Sat, Sep 28, 2019 at 11:03:48PM +0200, Paul Gevers wrote:
> Hi Salvatore,
> 
> On 28-09-2019 23:41, Salvatore Bonaccorso wrote:
> >> So I believe the affected code was only introduced then.
> > 
> > I tried to get an idea here, but still I'm not sure 100%. Isn't for
> > instance the is_graph_allowed check missing in e.g. graph_xport.php,
> > so before accessing the graph_info, there is no check for if the user
> > is allowed to access the graph. For other parts this is done in
> > 0.8.8h.
> > 
> > When in doupt, I rather would prefer to "wrongly" mark something as
> > affected rather than triage it as not-affected, and later to be turned
> > wrong.
> > 
> > Although the CVE assignment is somehow specific to the graph_json.php
> > part, which is not present in 0.8.8h I'm raising still the above, as
> > upstream has at least decided to cover the other changes for
> > permission checks in the two related commits.
> > 
> > Is upstream available to check and to confirm the stretch version is
> > not affected despite the potential missing permission checks there?
> 
> I already noted on IRC the other day that I think the pre 1 code is
> affected as well. So I agree with your assessment.

Ack, thanks for confirming (and regarding the note on IRC, I guess I
just missed it).

Regards,
Salvatore


From owner at bugs.debian.org  Sun Sep 29 07:57:04 2019
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Sun, 29 Sep 2019 06:57:04 +0000
Subject: [Pkg-cacti-maint] Processed: found 941036 in 1.2.2+ds1-2+deb10u1,
 found 941036 in 1.2.2+ds1-2, found 941036 in 0.8.8h+ds1-10
References: <1569740081-3092-bts-carnil@debian.org>
Message-ID: <handler.s.C.15697400865037.transcript@bugs.debian.org>

Processing commands for control at bugs.debian.org:

> found 941036 1.2.2+ds1-2+deb10u1
Bug #941036 [src:cacti] cacti: CVE-2019-16723
Marked as found in versions cacti/1.2.2+ds1-2+deb10u1.
> found 941036 1.2.2+ds1-2
Bug #941036 [src:cacti] cacti: CVE-2019-16723
Marked as found in versions cacti/1.2.2+ds1-2.
> found 941036 0.8.8h+ds1-10
Bug #941036 [src:cacti] cacti: CVE-2019-16723
Marked as found in versions cacti/0.8.8h+ds1-10.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
941036: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=941036
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems


From noreply at release.debian.org  Mon Sep 30 05:39:09 2019
From: noreply at release.debian.org (Debian testing watch)
Date: Mon, 30 Sep 2019 04:39:09 +0000
Subject: [Pkg-cacti-maint] cacti 1.2.6+ds1-3 MIGRATED to testing
Message-ID: <E1iEnSn-0000lE-5m@respighi.debian.org>

FYI: The status of the cacti source package
in Debian's testing distribution has changed.

  Previous version: 1.2.4+ds1-2
  Current version:  1.2.6+ds1-3

-- 
This email is automatically generated once a day.  As the installation of
new packages into testing happens multiple times a day you will receive
later changes on the next day.
See https://release.debian.org/testing-watch/ for more information.


From info19alpha at gmail.com  Mon Sep 30 10:02:04 2019
From: info19alpha at gmail.com (Izadin Aris)
Date: Mon, 30 Sep 2019 10:02:04 +0100
Subject: [Pkg-cacti-maint] ABOUT OUR BUSINESS NEGOTIATIONS
Message-ID: <CAA7etL57V65LHA39AAEtjswBbBd4tU1wdJfdWGE7j9SQU0oMtQ@mail.gmail.com>

-- 
Hello.

WE WANT TO INVEST WITH YOU,

We are personal fund managers and we seek individual and businesses in
your country who are willing to manage funds that we will invest with
them. The fund manager (i.e you) can choose to invest the fund in any
business and country he likes and make an agreed single digit annual
return to the investor.
Also he gets an agreed % of the capital invested for his efforts
We have an array of clients with varied backgrounds who seek to make
invest discretely in countries other than their's but have no
guaranteed/reliable access/individuals to those business climes.

If you have credible projects in need of funding of over a million but
below a billion or existing businesses requiring expansion,
researches, novelle business ideas etc we would be delighted to work
with you

Sincerely,

Izadin Aris
Managing Agent.


From jspagolla at lrhcares.org  Mon Sep 30 15:38:14 2019
From: jspagolla at lrhcares.org (Juergen Spagolla)
Date: Mon, 30 Sep 2019 14:38:14 +0000
Subject: [Pkg-cacti-maint] Do you need personal loan or loan to finance a
 business at 3% per year, for more info ,
 contact us via:  sigmafinanceplc@gmail.com
Message-ID: <AC4FE10B2D01D34FAA83E522A6335941EC92E198@lrhexmbx1.lh.org>

Benötigen Sie ein persönliches Darlehen oder ein Darlehen zur Finanzierung eines Unternehmens zu 3% pro Jahr? Weitere Informationen erhalten Sie von uns unter: sigmafinanceplc at gmail.com

The information contained in this message may be confidential and protected from disclosure under applicable law.  These materials are intended only for the use of the intended recipient.  If you are not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.  If you have received this communication in error, please notify us immediately by replying to this message and then delete it from your computer.  All e-mail sent to this address will be received by the Littleton Regional Healthcare e-mail system and is subject to archiving and review by someone other than the intended recipient such as technical support and/or management personnel."




From debian-bts-link at lists.debian.org  Mon Sep 30 20:28:21 2019
From: debian-bts-link at lists.debian.org (debian-bts-link at lists.debian.org)
Date: Mon, 30 Sep 2019 19:28:21 +0000
Subject: [Pkg-cacti-maint] [bts-link] source package src:cacti
Message-ID: <156987170148.26569.6507765396728963289.btslink@sonntag.debian.org>

#
# bts-link upstream status pull for source package src:cacti
# see http://lists.debian.org/debian-devel-announce/2006/05/msg00001.html
#     https://bts-link-team.pages.debian.net/bts-link/
#

user debian-bts-link at lists.debian.org

# remote status report for #941036 (http://bugs.debian.org/941036)
# Bug title: cacti: CVE-2019-16723
#  * https://github.com/Cacti/cacti/issues/2964
#  * remote status changed: (?) -> closed
#  * closed upstream
tags 941036 + fixed-upstream
usertags 941036 + status-closed

thanks


From owner at bugs.debian.org  Mon Sep 30 20:33:15 2019
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Mon, 30 Sep 2019 19:33:15 +0000
Subject: [Pkg-cacti-maint] Processed: [bts-link] source package src:cacti
References: <156987170148.26569.6507765396728963289.btslink@sonntag.debian.org>
Message-ID: <handler.s.C.156987170611415.transcript@bugs.debian.org>

Processing commands for control at bugs.debian.org:

> #
> # bts-link upstream status pull for source package src:cacti
> # see http://lists.debian.org/debian-devel-announce/2006/05/msg00001.html
> #     https://bts-link-team.pages.debian.net/bts-link/
> #
> user debian-bts-link at lists.debian.org
Setting user to debian-bts-link at lists.debian.org (was debian-bts-link at lists.debian.org).
> # remote status report for #941036 (http://bugs.debian.org/941036)
> # Bug title: cacti: CVE-2019-16723
> #  * https://github.com/Cacti/cacti/issues/2964
> #  * remote status changed: (?) -> closed
> #  * closed upstream
> tags 941036 + fixed-upstream
Bug #941036 [src:cacti] cacti: CVE-2019-16723
Added tag(s) fixed-upstream.
> usertags 941036 + status-closed
There were no usertags set.
Usertags are now: status-closed.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
941036: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=941036
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems


