FEDORA-EPEL-2025-ba03a05138 — security update for cacti and cacti-spine

stable

cacti-1.2.30-1.el8 and cacti-spine-1.2.30-1.el8

FEDORA-EPEL-2025-ba03a05138 created by carlwgeorge 4 weeks ago for Fedora EPEL 8

Update cacti and cacti-spine to version 1.2.30. This includes the upstream fixes for many CVEs, including several remote code execution bugs.

This update's test gating status has been changed to 'waiting'.

4 weeks ago

This update has been submitted for testing by bodhi.

4 weeks ago

This update's test gating status has been changed to 'ignored'.

4 weeks ago

carlwgeorge edited this update.

4 weeks ago

This update has been pushed to testing.

4 weeks ago

This update has been submitted for stable by bodhi.

3 weeks ago

This update has been pushed to stable.

3 weeks ago

Please login to add feedback.

Metadata

Type

security

Severity

urgent

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

7 days

Dates

submitted

4 weeks ago

in testing

4 weeks ago

in stable

3 weeks ago

modified

4 weeks ago

approved

3 weeks ago

Builds

cacti-1.2.30-1.el8

cacti-spine-1.2.30-1.el8

BZ#2317098 CVE-2024-43363 cacti: Remote code execution via Log Poisoning in Cacti [epel-8]

BZ#2317101 CVE-2024-43362 cacti: Stored Cross-site Scripting (XSS) when creating external links in Cacti [epel-8]

BZ#2317105 CVE-2024-43364 cacti: Stored Cross-site Scripting (XSS) when creating external links in Cacti [epel-8]

BZ#2317108 CVE-2024-43365 cacti: Stored Cross-site Scripting (XSS) when creating external links in Cacti [epel-8]

BZ#2342333 CVE-2024-45598 cacti: Cacti has a Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log Path [epel-8]

BZ#2342339 CVE-2025-24367 cacti: Cacti allows Arbitrary File Creation leading to RCE [epel-8]

BZ#2342354 CVE-2025-24368 cacti: Cacti has a SQL Injection vulnerability when using tree rules through Automation API [epel-8]

BZ#2342357 CVE-2025-22604 cacti: Cacti has Authenticated RCE via multi-line SNMP responses [epel-8]

BZ#2342359 CVE-2024-54146 cacti: Cacti has a SQL Injection vulnerability when view host template [epel-8]

BZ#2342361 CVE-2024-54145 cacti: Cacti has a SQL Injection vulnerability when request automation devices [epel-8]

BZ#2345160 CVE-2025-26520 cacti: SQL Injection in Cacti [epel-8]

cacti-1.2.30-1.el8

cacti-spine-1.2.30-1.el8

Automated Test Results

ignored