openSUSE Build Service

Overview Details Repositories Revisions Requests Users Attributes Meta

Security update for cacti, cacti-spine

This update for cacti, cacti-spine fixes the following issues:

cacti-spine was updated to version 1.2.9.

Security issues fixed:

- CVE-2009-4112: Fixed a privilege escalation (bsc#1122535).
- CVE-2018-20723: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122245).
- CVE-2018-20724: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122244).
- CVE-2018-20725: Fixed a privilege escalation that could occur under certain conditions (bsc#1122535).
- CVE-2018-20726: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122242).
- CVE-2019-16723: Fixed an authentication bypass vulnerability.
- CVE-2019-17357: Fixed an SQL injection vulnerability (bsc#1158990).
- CVE-2019-17358: Fixed an unsafe deserialization in sanitize_unserialize_selected_items (bsc#1158992).
- CVE-2020-7106: Fixed a potential cross-site scripting (XSS) vulnerability (bsc#1163749).
- CVE-2020-7237: Fixed a remote code execution that affected privileged users via shell metacharacters in the Performance Boost Debug Log field (bsc#1161297).

Non-security issues fixed:

- Fixed missing packages php-json, php-ctype, and php-gd in cacti.spec (boo#1101024).
- Fixed Apache2.4 and Apache2.2 runtime configuration issue (boo#1101139).

Submitted by Andreas Stieger (AndreasStieger)

Fixed bugs

cacti.conf Apache Invalid command 'Order'

bnc#1161297

VUL-0: CVE-2020-7237: cacti: Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php

bnc#1158992

VUL-0: CVE-2019-17358: cacti: Unsafe deserialization in sanitize_unserialize_selected_items

bnc#1122535

VUL-1: CVE-2009-4112: cacti: Privilege escalation under certain conditions

bnc#1122244

VUL-1: CVE-2018-20724: cacti: cross-site scripting (XSS) vulnerability exists in pollers.php due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.

bnc#1122243

VUL-1: CVE-2018-20725: cacti: cross-site scripting (XSS) vulnerability exists in graph_templates.php due to lack of escaping of unintended characters in the Graph Vertical Label.

bnc#1122242

VUL-1: CVE-2018-20726: cacti: cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti in the Website Hostname field for Devices.

bnc#1101024

missing php packages in cacti.spec

bnc#1158990

VUL-0: CVE-2019-17357: cacti: sql injection in graphs.php

bnc#1082318

Packages must not mark license files as %doc

bnc#1122245

VUL-1: CVE-2018-20723: cacti: cross-site scripting (XSS) vulnerability exists in color_templates.php due to lack of escaping of unintended characters in the Name field for a Color.

bnc#1163749

VUL-0: CVE-2020-7106: cacti: Lack of escaping on some pages can lead to XSS exposure

Places

Fixed bugs

Selected Binaries

Places