-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3309-1 debian-...@lists.debian.org https://www.debian.org/lts/security/ Chris Lamb February 06, 2023 https://wiki.debian.org/LTS - -------------------------------------------------------------------------
Package : graphite-web Version : 1.1.4-3+deb10u2 CVE IDs : CVE-2022-4728 CVE-2022-4729 CVE-2022-4730 Debian Bug : 1026992 It was discovered that there were a number of issues in graphite-web, a tool provide realtime graphing of system statistics etc. A series of cross-site scripting (XSS) vulnerabilties existed that could have been exploited remotely. Issues existed in the Cookie Handler, Template Name Handler and Absolute Time Range Handler components. For Debian 10 buster, these problems have been fixed in version 1.1.4-3+deb10u2. We recommend that you upgrade your graphite-web packages. For the detailed security status of graphite-web please refer to its security tracker page at: https://security-tracker.debian.org/tracker/graphite-web Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmPhbBUACgkQHpU+J9Qx Hlhd2Q//WCgFbzbyZ8l2PCPbLbUw2al3dvCBOpQGMnircZMhrUhsks0H7EruHdNK GQs9oxLzYEXANmxT9yBPjIPz6ndEkfRVF+02U/XVY5JmkEZpOjgoQJkdAiq49vJH nHh2bpoaVFk/F2e16QGKIJL2tWgrIOWjqmub5oncIiCsH/Hs5O6OVNaghBm4NPac GEzOls/q6VPRN2NqGH9j47l/KQrkw9Z+3pM+C+F64cX5zTXjzrF9HJs5MHdbRlnR TzA/x3aZnToL7pXArn5+NsOpV4aJcxpIM/Y/m3NA0FiXaQUXWY1w8lDKDdAvQcTL +VioO53cJ6dRgfIZxDmpJ3piQo0wIB8qhmaY0RZiXqOntbnmhdKwXHV8W9Zncke8 nHqOI+8DUXL6KIJxLnIrXwiUY75UqbkOtBPCk1Ag4c6zCL+GpKJHnxnzyYD4RBYH NNwof6m63IpfuxWWmZPChja9AbUIpc6qE3i4lU0JcDAWRHmpRjsXUiwp/bVdD4aX 25j8js0nsUD3iWFEoz1v47zf8IVEb4JGAeswiUEwIIm7DvSSpn2cum8NbjT6sdJo O2pX0L5ghmnPQoaLiNTrQf9/IlveiF9AzhYjlqQomOGqesL9YWYCZ5RAG7n2phR+ pVp6jIAte7rJfLSELpE1J5UTEDPWX5w/aGWqbuMsu1blg9nOjIo= =YIF4 -----END PGP SIGNATURE-----