CVE-2017-11163

Debian Bug report logs - #868080
CVE-2017-11163

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2017-11163

Date: Tue, 11 Jul 2017 23:13:39 +0200

Package: cacti
Severity: important
Tags: security

This was assigned CVE-2017-11163:
https://github.com/Cacti/cacti/issues/847

Cheers,
        Moritz

Message #10 received at 868080-done@bugs.debian.org (full text, mbox, reply):

From: Paul Gevers <elbrus@debian.org>

To: 868080-done@bugs.debian.org

Subject: Re: Bug#868080: CVE-2017-11163

Date: Wed, 12 Jul 2017 07:12:15 +0200

[Message part 1 (text/plain, inline)]

Version: 1.1.12+ds1-1

Hi Moritz,

On 07/11/17 23:13, Moritz Muehlenhoff wrote:
> Package: cacti
> Severity: important
> Tags: security
> 
> This was assigned CVE-2017-11163:
> https://github.com/Cacti/cacti/issues/847

According to upstream already fixed by the patch for CVE-2017-10970,
which is in unstable.

Probably, but haven't checked yet, this is new in 1.x, so I expect non
of the releases of Debian should be susceptible. Obviously one shouldn't
take my hunch feeling for this.

I'll investigate further tonight.

Paul

[signature.asc (application/pgp-signature, attachment)]

Message #15 received at 868080@bugs.debian.org (full text, mbox, reply):

From: Paul Gevers <elbrus@debian.org>

To: Debian Security <security@debian.org>, 868080@bugs.debian.org

Subject: Re: Bug#868080: CVE-2017-11163

Date: Wed, 12 Jul 2017 20:11:23 +0200

[Message part 1 (text/plain, inline)]

Hi,

On 07/11/17 23:13, Moritz Muehlenhoff wrote:
> Package: cacti
> Severity: important
> Tags: security
> 
> This was assigned CVE-2017-11163:
> https://github.com/Cacti/cacti/issues/847

The root cause of this CVE is the same as CVE-2017-11163. Upstream is
even surprised that a new CVE is assigned to this issue, see:
https://github.com/Cacti/cacti/issues/847#issuecomment-314746041 and the
next message (cigamit is upstream, mortenstevens is a Fedora maintainer).

Paul

[signature.asc (application/pgp-signature, attachment)]

Send a report that this bug log contains spam.