Your message dated Wed, 29 Jan 2025 23:22:02 +0000
with message-id <[email protected]>
and subject line Bug#1094574: fixed in cacti 1.2.28+ds1-4
has caused the Debian Bug report #1094574,
regarding cacti: CVE-2024-45598 CVE-2024-54145 CVE-2024-54146 CVE-2025-22604
CVE-2025-24367 CVE-2025-24368
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1094574: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1094574
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: cacti
Version: 1.2.28+ds1-3
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for cacti.
CVE-2024-45598[0]:
| Cacti is an open source performance and fault management framework.
| Prior to 1.2.29, an administrator can change the `Poller Standard
| Error Log Path` parameter in either Installation Step 5 or in
| Configuration->Settings->Paths tab to a local file inside the
| server. Then simply going to Logs tab and selecting the name of the
| local file will show its content on the web UI. This vulnerability
| is fixed in 1.2.29.
CVE-2024-54145[1]:
| Cacti is an open source performance and fault management framework.
| Cacti has a SQL injection vulnerability in the get_discovery_results
| function of automation_devices.php using the network parameter. This
| vulnerability is fixed in 1.2.29.
CVE-2024-54146[2]:
| Cacti is an open source performance and fault management framework.
| Cacti has a SQL injection vulnerability in the template function of
| host_templates.php using the graph_template parameter. This
| vulnerability is fixed in 1.2.29.
CVE-2025-22604[3]:
| Cacti is an open source performance and fault management framework.
| Due to a flaw in multi-line SNMP result parser, authenticated users
| can inject malformed OIDs in the response. When processed by
| ss_net_snmp_disk_io() or ss_net_snmp_disk_bytes(), a part of each
| OID will be used as a key in an array that is used as part of a
| system command, causing a command execution vulnerability. This
| vulnerability is fixed in 1.2.29.
CVE-2025-24367[4]:
| Cacti is an open source performance and fault management framework.
| An authenticated Cacti user can abuse graph creation and graph
| template functionality to create arbitrary PHP scripts in the web
| root of the application, leading to remote code execution on the
| server. This vulnerability is fixed in 1.2.29.
CVE-2025-24368[5]:
| Cacti is an open source performance and fault management framework.
| Some of the data stored in automation_tree_rules.php is not
| thoroughly checked and is used to concatenate the SQL statement in
| build_rule_item_filter() function from lib/api_automation.php,
| resulting in SQL injection. This vulnerability is fixed in 1.2.29.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
Commits are found in the security-tracker references directly.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2024-45598
https://www.cve.org/CVERecord?id=CVE-2024-45598
[1] https://security-tracker.debian.org/tracker/CVE-2024-54145
https://www.cve.org/CVERecord?id=CVE-2024-54145
[2] https://security-tracker.debian.org/tracker/CVE-2024-54146
https://www.cve.org/CVERecord?id=CVE-2024-54146
[3] https://security-tracker.debian.org/tracker/CVE-2025-22604
https://www.cve.org/CVERecord?id=CVE-2025-22604
[4] https://security-tracker.debian.org/tracker/CVE-2025-24367
https://www.cve.org/CVERecord?id=CVE-2025-24367
[5] https://security-tracker.debian.org/tracker/CVE-2025-24368
https://www.cve.org/CVERecord?id=CVE-2025-24368
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: cacti
Source-Version: 1.2.28+ds1-4
Done: Paul Gevers <[email protected]>
We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Paul Gevers <[email protected]> (supplier of updated cacti package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 29 Jan 2025 21:01:27 +0100
Source: cacti
Architecture: source
Version: 1.2.28+ds1-4
Distribution: unstable
Urgency: medium
Maintainer: Cacti Maintainer <[email protected]>
Changed-By: Paul Gevers <[email protected]>
Closes: 1038924 1094574
Changes:
cacti (1.2.28+ds1-4) unstable; urgency=medium
.
* Add Romanian translation for debconf templates (Closes: #1038924)
* Adapt and apply 0001-QA-1.2.29-Security-Updates-6074.patch
CVE-2024-45598 CVE-2024-54145 CVE-2024-54146 CVE-2025-22604
CVE-2025-24367 CVE-2025-24368
(Closes: #1094574)
Checksums-Sha1:
9c84bcd4eb2dae2c96cf46cd852e76bf589b75e7 2231 cacti_1.2.28+ds1-4.dsc
afc509fd8fb97a9f1f448c19859dc59984ba155f 61788 cacti_1.2.28+ds1-4.debian.tar.xz
Checksums-Sha256:
ddf666878f192d90b27c4e57bc8e401ee32245fbbb9c3882e50ee164cd4c2cfe 2231
cacti_1.2.28+ds1-4.dsc
315ac9ba2c785462b5397c7fba67553fd59ac60a75152cfd897b057fbd8860b3 61788
cacti_1.2.28+ds1-4.debian.tar.xz
Files:
1604b7fa0e05f150953896272e9a9d2c 2231 web optional cacti_1.2.28+ds1-4.dsc
e0a7707a1869aa6c520d9296583c70c6 61788 web optional
cacti_1.2.28+ds1-4.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEEWLZtSHNr6TsFLeZynFyZ6wW9dQoFAmeaoPIACgkQnFyZ6wW9
dQr0TAf/ecqekLma83QFMt3oprEYxeoZwAplsWJOwaY74PLfknjgC4bBgl0ZEw0L
B9lOLNzRkfWagJE8czw/EpLLbuNQYv8fkuADmmdOYhUmyHjH8Cyf0n63M82nnXoy
8hybaqv69mVqCGIXzKtZiZNg1szby9nG+Jv3+Xqx4kolntT/HbBT57hHJBj2LIUp
klLdTt8WGwNRFihiw8w2DXAKQa8vN+u4K8K8guXAhMWIhkc+9o/A13ZxaZqPg/+X
RKoHY9EUj6rc1FtRMadyVGNeuJ9MoTUJTuYdQPWGquYPF+lURvdjVNV84uUA0iEL
ezbejl2QhB1UeVL9GfCQSsBLn7Mk2Q==
=QhH5
-----END PGP SIGNATURE-----
pgpimTcT3F27N.pgp
Description: PGP signature
--- End Message ---
