openSUSE-SU-2020:0272-1

Import Source

JSON Data

https://api.osv.dev/v1/vulns/openSUSE-SU-2020:0272-1

Related

Published

2020-03-01T17:12:57Z

Modified

2020-03-01T17:12:57Z

Summary

Security update for cacti, cacti-spine

Details

This update for cacti, cacti-spine fixes the following issues:

cacti-spine was updated to version 1.2.9.

Security issues fixed:

CVE-2009-4112: Fixed a privilege escalation (bsc#1122535).
CVE-2018-20723: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122245).
CVE-2018-20724: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122244).
CVE-2018-20725: Fixed a privilege escalation that could occur under certain conditions (bsc#1122535).
CVE-2018-20726: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122242).
CVE-2019-16723: Fixed an authentication bypass vulnerability.
CVE-2019-17357: Fixed an SQL injection vulnerability (bsc#1158990).
CVE-2019-17358: Fixed an unsafe deserialization in sanitizeunserializeselected_items (bsc#1158992).
CVE-2020-7106: Fixed a potential cross-site scripting (XSS) vulnerability (bsc#1163749).
CVE-2020-7237: Fixed a remote code execution that affected privileged users via shell metacharacters in the Performance Boost Debug Log field (bsc#1161297).

Non-security issues fixed:

Fixed missing packages php-json, php-ctype, and php-gd in cacti.spec (boo#1101024).
Fixed Apache2.4 and Apache2.2 runtime configuration issue (boo#1101139).

References

Affected packages

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.9-lp151.3.3.1

{
    "binaries": [
        {
            "cacti": "1.2.9-lp151.3.3.1",
            "cacti-spine": "1.2.9-lp151.3.3.1"
        }
    ]
}

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.9-lp151.3.3.1

{
    "binaries": [
        {
            "cacti": "1.2.9-lp151.3.3.1",
            "cacti-spine": "1.2.9-lp151.3.3.1"
        }
    ]
}