From noreply at release.debian.org  Sat Feb  1 04:39:07 2025
From: noreply at release.debian.org (Debian testing watch)
Date: Sat, 01 Feb 2025 04:39:07 +0000
Subject: [Pkg-cacti-maint] cacti 1.2.28+ds1-4 MIGRATED to testing
Message-ID: <E1te5Hf-003vyV-1n@respighi.debian.org>

FYI: The status of the cacti source package
in Debian's testing distribution has changed.

  Previous version: 1.2.28+ds1-3
  Current version:  1.2.28+ds1-4

-- 
This email is automatically generated once a day.  As the installation of
new packages into testing happens multiple times a day you will receive
later changes on the next day.
See https://release.debian.org/testing-watch/ for more information.


From noreply at release.debian.org  Sun Feb  2 04:40:24 2025
From: noreply at release.debian.org (Debian testing autoremoval watch)
Date: Sun, 02 Feb 2025 04:40:24 +0000
Subject: [Pkg-cacti-maint] cacti is marked for autoremoval from testing
Message-ID: <E1teRmS-005Fzz-U6@respighi.debian.org>

cacti 1.2.28+ds1-4 is marked for autoremoval from testing on 2025-03-09

It (build-)depends on packages with these RC bugs:
1094058: fonts-fork-awesome: FTBFS: /usr/lib/ruby/vendor_ruby/fontcustom/options.rb:50:in `set_config_path': undefined method `exists?' for class File (NoMethodError)
 https://bugs.debian.org/1094058



For more information on the autoremoval process, including hints to prevent
autoremoval can be found on the wiki: https://wiki.debian.org/Autoremoval

This mail is generated by:
https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/mail_autoremovals.pl

Autoremoval data is generated by:
https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gatherer.pl


From owner at bugs.debian.org  Mon Feb 10 15:42:02 2025
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Mon, 10 Feb 2025 15:42:02 +0000
Subject: [Pkg-cacti-maint] Processed: found 1094574 in 1.2.24+ds1-1+deb12u4
References: <1739202016-2969-bts-carnil@debian.org>
Message-ID: <handler.s.C.1739202020571756.transcript@bugs.debian.org>

Processing commands for control at bugs.debian.org:

> found 1094574 1.2.24+ds1-1+deb12u4
Bug #1094574 {Done: Paul Gevers <elbrus at debian.org>} [src:cacti] cacti: CVE-2024-45598 CVE-2024-54145 CVE-2024-54146 CVE-2025-22604 CVE-2025-24367 CVE-2025-24368
Marked as found in versions cacti/1.2.24+ds1-1+deb12u4.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
1094574: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1094574
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems


From owner at bugs.debian.org  Mon Feb 10 15:42:02 2025
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Mon, 10 Feb 2025 15:42:02 +0000
Subject: [Pkg-cacti-maint] Processed: closing 1094574
References: <1739201965-601-bts-carnil@debian.org>
Message-ID: <handler.s.C.1739201972571259.transcript@bugs.debian.org>

Processing commands for control at bugs.debian.org:

> close 1094574 1.2.24+ds1-1+deb12u5
Bug #1094574 {Done: Paul Gevers <elbrus at debian.org>} [src:cacti] cacti: CVE-2024-45598 CVE-2024-54145 CVE-2024-54146 CVE-2025-22604 CVE-2025-24367 CVE-2025-24368
The source 'cacti' and version '1.2.24+ds1-1+deb12u5' do not appear to match any binary packages
Marked as fixed in versions cacti/1.2.24+ds1-1+deb12u5.
Bug #1094574 {Done: Paul Gevers <elbrus at debian.org>} [src:cacti] cacti: CVE-2024-45598 CVE-2024-54145 CVE-2024-54146 CVE-2025-22604 CVE-2025-24367 CVE-2025-24368
Bug 1094574 is already marked as done; not doing anything.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
1094574: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1094574
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems


From ftpmaster at ftp-master.debian.org  Mon Feb 10 16:04:31 2025
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Mon, 10 Feb 2025 16:04:31 +0000
Subject: [Pkg-cacti-maint] cacti_1.2.24+ds1-1+deb12u5_source.changes
 ACCEPTED into proposed-updates->stable-new
Message-ID: <E1thWGt-00HAFU-76@fasolo.debian.org>

Thank you for your contribution to Debian.

Mapping stable-security to proposed-updates.

Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 09 Feb 2025 14:36:48 +0000
Source: cacti
Architecture: source
Version: 1.2.24+ds1-1+deb12u5
Distribution: bookworm-security
Urgency: medium
Maintainer: Cacti Maintainer <pkg-cacti-maint at lists.alioth.debian.org>
Changed-By: Bastien Roucari?s <rouca at debian.org>
Changes:
 cacti (1.2.24+ds1-1+deb12u5) bookworm-security; urgency=medium
 .
   * Non-maintainer upload by the Security Team.
   * Fix CVE-2024-27082: Stored XSS vulnerability.
   * Fix CVE-2024-43362: XSS (Cross-Site Scripting) Vulnerability.
     The `fileurl` parameter is not properly sanitized when
     saving external links in `links.php` . Morever, the said
     fileurl is placed in some html code which is passed to
     the `print` function in `link.php` and `index.php`,
     finally leading to stored XSS
   * Fix CVE-2024-43363: Remote Code Execution (RCE) by
     log poisoning. An admin user can create a device with
     a malicious hostname containing php code and repeat
     the installation process to use a php file as the
     cacti log file. After having the malicious hostname end
     up in the logs (log poisoning), one can simply go to the
     log file url to execute commands to achieve RCE.
   * Fix CVE-2024-43364: Stored XSS (Cross-Site Scripting) Vulnerability.
     The `title` parameter is not properly sanitized when
     saving external links in links.php . Morever, the said
     title parameter is stored in the database and reflected back
     to user in index.php, finally leading to stored XSS.
   * Fix CVE-2024-43365: Stored XSS (Cross-Site Scripting) Vulnerability.
     The`consolenewsection` parameter is not properly sanitized
     when saving external links in links.php . Morever, the said
     consolenewsection parameter is stored in the database and
     reflected back to user in `index.php`, finally leading
     to stored XSS.
   * Fix CVE-2024-45598: Local File Inclusion (LFI) Vulnerability
     via Poller Standard Error Log Path.
     An admin can change Poller Standard Error Log Path parameter in
     either Installation Step 5 or in Configuration->Settings->Paths tab
     to a local file inside the server. Then simply going to Logs tab and
     selecting the name of the local file will show its content
     on the web UI.
   * Fix CVE-2024-54145: SQL Injection vulnerability when request
     automation devices.
     A SQL injection vulnerability in get_discovery_results function
     of automation_devices.php.paramter networkconcat into
     sql_wherewithout Sufficient filtration.
   * Fix CVE-2025-22604: Authenticated RCE via multi-line SNMP responses
     Due to a flaw in multi-line SNMP result parser, authenticated users
     can inject malformed OIDs in the response. When processed by
     ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), a part of each
     OID will be used as a key in an array that is used as part of a
     system command, causing a command execution vulnerability.
   * Fix CVE-2025-24367: Arbitrary File Creation leading to RCE
     An authenticated Cacti user can abuse graph creation and graph
     template functionality to create arbitrary PHP scripts in the
     web root of the application, leading to remote code
     execution on the server.
   * Fix CVE-2025-24368: SQL Injection vulnerability when using
     tree rules through Automation API
     Some of the data stored in automation_tree_rules.php is not
     thoroughly checked and is used to concatenate the SQL statement in
     build_rule_item_filter() function from lib/api_automation.php ,*
     finally resulting in SQL injection.
Checksums-Sha1:
 8b0ded08f8413a199c300c3000ba399cbcddf697 2500 cacti_1.2.24+ds1-1+deb12u5.dsc
 dddbad3784e15fb61ceb9f0c649e45711d6bf7e3 24226965 cacti_1.2.24+ds1.orig-docs-source.tar.gz
 6f258f06289889566b7d6a255b904aae9756d97d 10026982 cacti_1.2.24+ds1.orig.tar.gz
 89cd7c2c50c9ee960a0ff4fbad9ad3801e5e3c7c 83448 cacti_1.2.24+ds1-1+deb12u5.debian.tar.xz
 c5846e7e879805110e9eedbd602c74f4cede3122 6531 cacti_1.2.24+ds1-1+deb12u5_amd64.buildinfo
Checksums-Sha256:
 a4f3d86407d43a9ca1fd0fd5275d5d68687b669bf1764ad89291f3632ae22e66 2500 cacti_1.2.24+ds1-1+deb12u5.dsc
 180acdab0fbbbae452bb6f46ad9d406cedcb540967410f71aa69be4a281bb74c 24226965 cacti_1.2.24+ds1.orig-docs-source.tar.gz
 4247d8120b0661a2019a0d39f35c6e84cfd4e4161e0791ff233c3e3bd2d571da 10026982 cacti_1.2.24+ds1.orig.tar.gz
 2f1cb9f3e23c23bd78aab21c479e1c3c098db2b2182adb6c1a404d06afa53a6b 83448 cacti_1.2.24+ds1-1+deb12u5.debian.tar.xz
 5c4d50bbc943a1b07cdc1fc626d5c7633d0e26834303094652329ed33e08e8e6 6531 cacti_1.2.24+ds1-1+deb12u5_amd64.buildinfo
Files:
 ca0826dafde2cbebd697b52bd061927a 2500 web optional cacti_1.2.24+ds1-1+deb12u5.dsc
 a05d1c5f50554a86fd0eb11f070594a7 24226965 web optional cacti_1.2.24+ds1.orig-docs-source.tar.gz
 69cdb0ae5b490a8328e99ad2f161aca6 10026982 web optional cacti_1.2.24+ds1.orig.tar.gz
 bc9b3a2fb4381dc3992d25d70ca5a0d4 83448 web optional cacti_1.2.24+ds1-1+deb12u5.debian.tar.xz
 29182c09e3c050e7768414c3b455f7f6 6531 web optional cacti_1.2.24+ds1-1+deb12u5_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----


m42skVU5xCLCZ7FDAFlPSJqZIqnbM0d5xIGhrQiwR2ngnzoULGg=
=Nh2y
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-cacti-maint/attachments/20250210/680888e7/attachment.sig>

From carnil at debian.org  Tue Feb 11 07:41:30 2025
From: carnil at debian.org (Salvatore Bonaccorso)
Date: Tue, 11 Feb 2025 08:41:30 +0100
Subject: [Pkg-cacti-maint] Bug#1095721: cacti: Incomplete fix for
 CVE-2024-54146
Message-ID: <173925969066.2068757.16026746050179036470.reportbug@eldamar.lan>

Source: cacti
Version: 1.2.28+ds1-4
Severity: important
Tags: security upstream
Forwarded: https://github.com/Cacti/cacti/pull/6096
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi

As reported by Sylvain, the fix for  CVE-2024-54146 was incomplete.

https://github.com/Cacti/cacti/pull/6096
https://github.com/Cacti/cacti/commit/7fa60c03ad4a69c701ac6b77c85a8927df7acd51

Regards,
Salvatore


From carnil at debian.org  Wed Feb 12 06:37:29 2025
From: carnil at debian.org (Salvatore Bonaccorso)
Date: Wed, 12 Feb 2025 07:37:29 +0100
Subject: [Pkg-cacti-maint] Bug#1095721: cacti: Incomplete fix for
 CVE-2024-54146
In-Reply-To: <173925969066.2068757.16026746050179036470.reportbug@eldamar.lan>
References: <173925969066.2068757.16026746050179036470.reportbug@eldamar.lan>
 <173925969066.2068757.16026746050179036470.reportbug@eldamar.lan>
Message-ID: <Z6xBqSKpCMQ_ufvn@eldamar.lan>

Control: retitle -1 cacti: CVE-2025-26520 (Incomplete fix for CVE-2024-54146)

On Tue, Feb 11, 2025 at 08:41:30AM +0100, Salvatore Bonaccorso wrote:
> Source: cacti
> Version: 1.2.28+ds1-4
> Severity: important
> Tags: security upstream
> Forwarded: https://github.com/Cacti/cacti/pull/6096
> X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
> 
> Hi
> 
> As reported by Sylvain, the fix for  CVE-2024-54146 was incomplete.
> 
> https://github.com/Cacti/cacti/pull/6096
> https://github.com/Cacti/cacti/commit/7fa60c03ad4a69c701ac6b77c85a8927df7acd51

This has a separate CVE, CVE-2025-26520.

Regards,
Salvatore


From owner at bugs.debian.org  Wed Feb 12 06:39:03 2025
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Wed, 12 Feb 2025 06:39:03 +0000
Subject: [Pkg-cacti-maint] Processed: Re: Bug#1095721: cacti: Incomplete fix
 for CVE-2024-54146
References: <Z6xBqSKpCMQ_ufvn@eldamar.lan>
 <173925969066.2068757.16026746050179036470.reportbug@eldamar.lan>
Message-ID: <handler.s.B1095721.17393422521976104.transcript@bugs.debian.org>

Processing control commands:

> retitle -1 cacti: CVE-2025-26520 (Incomplete fix for CVE-2024-54146)
Bug #1095721 [src:cacti] cacti: Incomplete fix for CVE-2024-54146
Changed Bug title to 'cacti: CVE-2025-26520 (Incomplete fix for CVE-2024-54146)' from 'cacti: Incomplete fix for CVE-2024-54146'.

-- 
1095721: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1095721
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems


From ftpmaster at ftp-master.debian.org  Sun Feb 16 11:32:09 2025
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Sun, 16 Feb 2025 11:32:09 +0000
Subject: [Pkg-cacti-maint] cacti_1.2.24+ds1-1+deb12u5_source.changes
 ACCEPTED into proposed-updates
Message-ID: <E1tjcsb-00BcZb-1O@fasolo.debian.org>

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 09 Feb 2025 14:36:48 +0000
Source: cacti
Architecture: source
Version: 1.2.24+ds1-1+deb12u5
Distribution: bookworm-security
Urgency: medium
Maintainer: Cacti Maintainer <pkg-cacti-maint at lists.alioth.debian.org>
Changed-By: Bastien Roucari?s <rouca at debian.org>
Changes:
 cacti (1.2.24+ds1-1+deb12u5) bookworm-security; urgency=medium
 .
   * Non-maintainer upload by the Security Team.
   * Fix CVE-2024-27082: Stored XSS vulnerability.
   * Fix CVE-2024-43362: XSS (Cross-Site Scripting) Vulnerability.
     The `fileurl` parameter is not properly sanitized when
     saving external links in `links.php` . Morever, the said
     fileurl is placed in some html code which is passed to
     the `print` function in `link.php` and `index.php`,
     finally leading to stored XSS
   * Fix CVE-2024-43363: Remote Code Execution (RCE) by
     log poisoning. An admin user can create a device with
     a malicious hostname containing php code and repeat
     the installation process to use a php file as the
     cacti log file. After having the malicious hostname end
     up in the logs (log poisoning), one can simply go to the
     log file url to execute commands to achieve RCE.
   * Fix CVE-2024-43364: Stored XSS (Cross-Site Scripting) Vulnerability.
     The `title` parameter is not properly sanitized when
     saving external links in links.php . Morever, the said
     title parameter is stored in the database and reflected back
     to user in index.php, finally leading to stored XSS.
   * Fix CVE-2024-43365: Stored XSS (Cross-Site Scripting) Vulnerability.
     The`consolenewsection` parameter is not properly sanitized
     when saving external links in links.php . Morever, the said
     consolenewsection parameter is stored in the database and
     reflected back to user in `index.php`, finally leading
     to stored XSS.
   * Fix CVE-2024-45598: Local File Inclusion (LFI) Vulnerability
     via Poller Standard Error Log Path.
     An admin can change Poller Standard Error Log Path parameter in
     either Installation Step 5 or in Configuration->Settings->Paths tab
     to a local file inside the server. Then simply going to Logs tab and
     selecting the name of the local file will show its content
     on the web UI.
   * Fix CVE-2024-54145: SQL Injection vulnerability when request
     automation devices.
     A SQL injection vulnerability in get_discovery_results function
     of automation_devices.php.paramter networkconcat into
     sql_wherewithout Sufficient filtration.
   * Fix CVE-2025-22604: Authenticated RCE via multi-line SNMP responses
     Due to a flaw in multi-line SNMP result parser, authenticated users
     can inject malformed OIDs in the response. When processed by
     ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), a part of each
     OID will be used as a key in an array that is used as part of a
     system command, causing a command execution vulnerability.
   * Fix CVE-2025-24367: Arbitrary File Creation leading to RCE
     An authenticated Cacti user can abuse graph creation and graph
     template functionality to create arbitrary PHP scripts in the
     web root of the application, leading to remote code
     execution on the server.
   * Fix CVE-2025-24368: SQL Injection vulnerability when using
     tree rules through Automation API
     Some of the data stored in automation_tree_rules.php is not
     thoroughly checked and is used to concatenate the SQL statement in
     build_rule_item_filter() function from lib/api_automation.php ,*
     finally resulting in SQL injection.
Checksums-Sha1:
 8b0ded08f8413a199c300c3000ba399cbcddf697 2500 cacti_1.2.24+ds1-1+deb12u5.dsc
 dddbad3784e15fb61ceb9f0c649e45711d6bf7e3 24226965 cacti_1.2.24+ds1.orig-docs-source.tar.gz
 6f258f06289889566b7d6a255b904aae9756d97d 10026982 cacti_1.2.24+ds1.orig.tar.gz
 89cd7c2c50c9ee960a0ff4fbad9ad3801e5e3c7c 83448 cacti_1.2.24+ds1-1+deb12u5.debian.tar.xz
 c5846e7e879805110e9eedbd602c74f4cede3122 6531 cacti_1.2.24+ds1-1+deb12u5_amd64.buildinfo
Checksums-Sha256:
 a4f3d86407d43a9ca1fd0fd5275d5d68687b669bf1764ad89291f3632ae22e66 2500 cacti_1.2.24+ds1-1+deb12u5.dsc
 180acdab0fbbbae452bb6f46ad9d406cedcb540967410f71aa69be4a281bb74c 24226965 cacti_1.2.24+ds1.orig-docs-source.tar.gz
 4247d8120b0661a2019a0d39f35c6e84cfd4e4161e0791ff233c3e3bd2d571da 10026982 cacti_1.2.24+ds1.orig.tar.gz
 2f1cb9f3e23c23bd78aab21c479e1c3c098db2b2182adb6c1a404d06afa53a6b 83448 cacti_1.2.24+ds1-1+deb12u5.debian.tar.xz
 5c4d50bbc943a1b07cdc1fc626d5c7633d0e26834303094652329ed33e08e8e6 6531 cacti_1.2.24+ds1-1+deb12u5_amd64.buildinfo
Files:
 ca0826dafde2cbebd697b52bd061927a 2500 web optional cacti_1.2.24+ds1-1+deb12u5.dsc
 a05d1c5f50554a86fd0eb11f070594a7 24226965 web optional cacti_1.2.24+ds1.orig-docs-source.tar.gz
 69cdb0ae5b490a8328e99ad2f161aca6 10026982 web optional cacti_1.2.24+ds1.orig.tar.gz
 bc9b3a2fb4381dc3992d25d70ca5a0d4 83448 web optional cacti_1.2.24+ds1-1+deb12u5.debian.tar.xz
 29182c09e3c050e7768414c3b455f7f6 6531 web optional cacti_1.2.24+ds1-1+deb12u5_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----


m42skVU5xCLCZ7FDAFlPSJqZIqnbM0d5xIGhrQiwR2ngnzoULGg=
=Nh2y
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-cacti-maint/attachments/20250216/3b07c1c9/attachment.sig>

From debian-bts-link at lists.debian.org  Mon Feb 17 17:33:08 2025
From: debian-bts-link at lists.debian.org (debian-bts-link at lists.debian.org)
Date: Mon, 17 Feb 2025 17:33:08 +0000
Subject: [Pkg-cacti-maint] [bts-link] source package src:cacti
Message-ID: <173981358806.3382698.6361494750786731232.btslink@sonntag.debian.org>

#
# bts-link upstream status pull for source package src:cacti
# see http://lists.debian.org/debian-devel-announce/2006/05/msg00001.html
#     https://bts-link-team.pages.debian.net/bts-link/
#

user debian-bts-link at lists.debian.org

# remote status report for #1095721 (http://bugs.debian.org/1095721)
# Bug title: cacti: CVE-2025-26520 (Incomplete fix for CVE-2024-54146)
#  * https://github.com/Cacti/cacti/pull/6096
#  * remote status changed: (?) -> closed
#  * closed upstream
tags 1095721 + fixed-upstream
usertags 1095721 + status-closed

thanks


From owner at bugs.debian.org  Mon Feb 17 17:36:09 2025
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Mon, 17 Feb 2025 17:36:09 +0000
Subject: [Pkg-cacti-maint] Processed: [bts-link] source package src:cacti
References: <173981358806.3382698.6361494750786731232.btslink@sonntag.debian.org>
Message-ID: <handler.s.C.17398135922520609.transcript@bugs.debian.org>

Processing commands for control at bugs.debian.org:

> #
> # bts-link upstream status pull for source package src:cacti
> # see http://lists.debian.org/debian-devel-announce/2006/05/msg00001.html
> #     https://bts-link-team.pages.debian.net/bts-link/
> #
> user debian-bts-link at lists.debian.org
Setting user to debian-bts-link at lists.debian.org (was debian-bts-link at lists.debian.org).
> # remote status report for #1095721 (http://bugs.debian.org/1095721)
> # Bug title: cacti: CVE-2025-26520 (Incomplete fix for CVE-2024-54146)
> #  * https://github.com/Cacti/cacti/pull/6096
> #  * remote status changed: (?) -> closed
> #  * closed upstream
> tags 1095721 + fixed-upstream
Bug #1095721 [src:cacti] cacti: CVE-2025-26520 (Incomplete fix for CVE-2024-54146)
Added tag(s) fixed-upstream.
> usertags 1095721 + status-closed
There were no usertags set.
Usertags are now: status-closed.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
1095721: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1095721
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems


