FEDORA-2023-248dff7cbe — security update for cacti and cacti-spine

stable

cacti-1.2.25-1.fc39 and cacti-spine-1.2.25-1.fc39

FEDORA-2023-248dff7cbe created by carlwgeorge 11 months ago for Fedora 39

Update cacti and cacti-spine to version 1.2.25. This includes the upstream fixes for many CVEs.

https://github.com/Cacti/cacti/releases/tag/release%2F1.2.25

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2023-248dff7cbe

This update has been submitted for testing by carlwgeorge.

11 months ago

This update's test gating status has been changed to 'ignored'.

11 months ago

This update has been pushed to testing.

11 months ago

This update has been submitted for stable by bodhi.

There is an ongoing freeze; this will be pushed to stable after the freeze is over.

11 months ago

This update has been pushed to stable.

10 months ago

Please login to add feedback.

Metadata

Type

security

Severity

high

Karma

Signed

Content Type

RPM

Test Gating

ignored

Builds

cacti-1.2.25-1.fc39

cacti-spine-1.2.25-1.fc39

Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

7 days

Dates

submitted

11 months ago

in testing

11 months ago

in stable

10 months ago

approved

11 months ago

BZ#2237577 CVE-2023-39512 cacti: Cross-Site Scripting vulnerability with Device Name when managing Data Sources [fedora-all]

BZ#2237582 CVE-2023-39514 cacti: Cross-Site Scripting vulnerability with Data Source Name when managing Graphs [fedora-all]

BZ#2237583 CVE-2023-39513 cacti: Cross-Site Scripting vulnerability with Device Name when debugging data queries [fedora-all]

BZ#2237585 CVE-2023-39515 cacti: Cross-Site Scripting vulnerability with Data Source Name when debugging Data Queries [fedora-all]

BZ#2237588 CVE-2023-39359 cacti: Authenticated SQL injection vulnerability when managing graphs [fedora-all]

BZ#2237592 CVE-2023-39360 cacti: Cross-Site Scripting vulnerability when creating new graphs [fedora-all]

BZ#2237597 CVE-2023-39361 cacti: Unauthenticated SQL Injection when viewing graphs [fedora-all]

BZ#2237600 CVE-2023-39366 cacti: Cross-Site Scripting vulnerability with Device Name when managing Data Sources [fedora-all]

BZ#2237603 CVE-2023-39510 cacti: Cross-Site Scripting vulnerability with Device Name when administrating Reports [fedora-all]

BZ#2237606 CVE-2023-39357 cacti: SQL Injection when saving data with sql_save() [fedora-all]

BZ#2237609 CVE-2023-39358 cacti: Authenticated SQL injection vulnerability when managing reports [fedora-all]

BZ#2237611 CVE-2023-39364 cacti: Open redirect in change password functionality [fedora-all]

BZ#2237615 CVE-2023-39365 cacti: SQL Injection when using regular expressions [fedora-all]

BZ#2237618 CVE-2023-30534 cacti: Insecure deserialization of filter data [fedora-all]

BZ#2237621 CVE-2023-31132 cacti: Privilege escalation when Cacti installed using Windows Installer defaults [fedora-all]

BZ#2237624 CVE-2023-39362 cacti: Authenticated command injection when using SNMP options [fedora-all]

BZ#2237627 CVE-2023-39516 cacti: Cross-Site Scripting vulnerability with Data Source Information when managing Data Sources [fedora-all]

BZ#2237819 CVE-2023-39511 cacti: Cross-Site Scripting vulnerability with Device Name when editing Graphs whilst managing Reports [fedora-all]

cacti-1.2.25-1.fc39

cacti-spine-1.2.25-1.fc39

Automated Test Results

ignored