[Pkg-graphite-maint] Bug#720454: graphite-web: CVE-2013-5093: Graphite remote code execution

Salvatore Bonaccorso carnil at debian.org
Thu Aug 22 06:10:00 UTC 2013


Package: graphite-web
Severity: grave
Tags: security upstream patch fixed-upstream

Hi,

the following vulnerability was published for graphite-web.

CVE-2013-5093[0]:
Graphite remote code execution

See the advisory in [1] and there are either patch[2] for 0.9.10 or
updating to 0.9.11/0.9.12 (which includes further fixes, see [3]).

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5093
    http://security-tracker.debian.org/tracker/CVE-2013-5093
[1] http://ceriksen.com/2013/08/20/graphite-remote-code-execution-vulnerability-advisory/
[2] https://gist.github.com/mleinart/6285953
[3] https://github.com/graphite-project/graphite-web/commit/5e87d8660223e90bd933d97ba578f2a289b8a288#L3R30

Regards,
Salvatore



More information about the Pkg-graphite-maint mailing list