-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Tue, 14 Nov 2017 20:14:34 +0100 Source: cacti Binary: cacti Architecture: source Version: 1.1.27+ds1-3 Distribution: unstable Urgency: medium Maintainer: Cacti Maintainer <pkg-cacti-maint@lists.alioth.debian.org> Changed-By: Paul Gevers <elbrus@debian.org> Description: cacti - web interface for graphing of monitoring systems Closes: 881110 Changes: cacti (1.1.27+ds1-3) unstable; urgency=medium . * CVE-2017-16641: remote authenticated administrators can execute arbitrary os commands via the path_rrdtool parameter in an action=save request to settings.php (Closes: #881110) * CVE-2017-16660: remote authenticated administrators can conduct Remote Code Execution attacks by placing the Log Path under the web root, and then making a remote_agent.php request containing PHP code in a Client-ip header * CVE-2017-16661: remote authenticated administrators can read arbitrary files accessible by the web-server user by placing the Log Path into a private directory, and then making a clog.php?filename= request * CVE-2017-16785: reflected XSS via the PATH_INFO to host.php (reintroduction of CVE-2017-15194) * Bump standards to 4.1.1 * Set Priority to optional Checksums-Sha1: 6da0c05e6b24552f8e3f4c0d995152531237f5e1 2134 cacti_1.1.27+ds1-3.dsc e0d1f509fb465f2c1676b254fc0d5b1362e9f7f5 56092 cacti_1.1.27+ds1-3.debian.tar.xz Checksums-Sha256: 9d77784c2545398d29f325c99764b1aebeb8966bb7d12e5c0dda78e7673306f3 2134 cacti_1.1.27+ds1-3.dsc 519db95eb5fd254f309faad31aaeb2d79fa1b2bbe8a8c604aa8b8fdcc7203f44 56092 cacti_1.1.27+ds1-3.debian.tar.xz Files: 2f7335b2759d8227a2b170074abf98de 2134 web optional cacti_1.1.27+ds1-3.dsc fd6375c1fc789d1654364421b949f5ac 56092 web optional cacti_1.1.27+ds1-3.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEWLZtSHNr6TsFLeZynFyZ6wW9dQoFAloLTQwACgkQnFyZ6wW9 dQpdEQgArlYK+cTh13PDHWpBbVGsg2TSH6vkIPQXUbM10uTcKHvgbd+vF83tYoh2 PQ+KHUImJhDc0Kd6bVfk9TixKG0KAm3FQ4sMleNCtQugoDKeR1qPadEbXlZB1GNp AqgAUvYfWWPF1u4bi/ZCB+WJULOeiU8J2WNCa64ppbSUpQLy2JD9kHaRuypYw3YQ 8KkC0eY7dTsaDzpjkQOYjZLXKiivvTRDh3oUYJ88mPJDcXIziC2a6in4lWUcQyho /fker79akY1cL6KDKoOdff8iq86V1h9WD9aLWetZu/SEw96ysWHHvu0fmM9IJmHa uEs97E9RHMxHHnsik8P970Z1cxUwag== =x3y5 -----END PGP SIGNATURE-----
