cacti: CVE-2019-16723

Debian Bug report logs - #941036
cacti: CVE-2019-16723

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: cacti: CVE-2019-16723

Date: Mon, 23 Sep 2019 22:20:27 +0200

Source: cacti
Version: 1.2.6+ds1-2
Severity: important
Tags: security upstream
Forwarded: https://github.com/Cacti/cacti/issues/2964

Hi,

The following vulnerability was published for cacti, filling for
tracking the upstream issue. At time of writing, I think there was not
a patch upstream yet.

CVE-2019-16723[0]:
| In Cacti through 1.2.6, authenticated users may bypass authorization
| checks (for viewing a graph) via a direct graph_json.php request with
| a modified local_graph_id parameter.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-16723
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16723
[1] https://github.com/Cacti/cacti/issues/2964

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 941036@bugs.debian.org (full text, mbox, reply):

From: Paul Gevers <elbrus@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 941036@bugs.debian.org

Subject: Re: Bug#941036: cacti: CVE-2019-16723

Date: Mon, 23 Sep 2019 22:28:31 +0200

[Message part 1 (text/plain, inline)]

Hi Salvatore,

Thanks for your report.

On 23-09-2019 22:20, Salvatore Bonaccorso wrote:
> The following vulnerability was published for cacti, filling for
> tracking the upstream issue. At time of writing, I think there was not
> a patch upstream yet.

I think there is:
https://github.com/Cacti/cacti/commit/7a6a17252a1cbda180b61fff244cb3ce797d5264

It mentioned the wrong issue, as documented here:
https://github.com/Cacti/cacti/commit/de3833b0414383efc9e075dd13c95925e2ca504c

Paul

[signature.asc (application/pgp-signature, attachment)]

Message #15 received at 941036@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Paul Gevers <elbrus@debian.org>

Cc: 941036@bugs.debian.org

Subject: Re: Bug#941036: cacti: CVE-2019-16723

Date: Tue, 24 Sep 2019 05:58:19 +0200

Hi Paul,

On Mon, Sep 23, 2019 at 10:28:31PM +0200, Paul Gevers wrote:
> Hi Salvatore,
> 
> Thanks for your report.
> 
> On 23-09-2019 22:20, Salvatore Bonaccorso wrote:
> > The following vulnerability was published for cacti, filling for
> > tracking the upstream issue. At time of writing, I think there was not
> > a patch upstream yet.
> 
> I think there is:
> https://github.com/Cacti/cacti/commit/7a6a17252a1cbda180b61fff244cb3ce797d5264
> 
> It mentioned the wrong issue, as documented here:
> https://github.com/Cacti/cacti/commit/de3833b0414383efc9e075dd13c95925e2ca504c

"Ack", thank you!

Regards,
Salvatore

Send a report that this bug log contains spam.