This update for cacti, cacti-spine to version 1.2.11 fixes the following issues:

This update is fixing multiple vulnerabilities and adding bug fixes. For more details consult the changes file.


              

References

---

• CVE: CVE-2020-8813
• CVE: CVE-2020-7237
• CVE: CVE-2020-7106
• CVE: CVE-2019-17358
• CVE: CVE-2019-17357
• CVE: CVE-2019-16723
• CVE: CVE-2018-20726
• CVE: CVE-2018-20725
• CVE: CVE-2018-20724
• CVE: CVE-2018-20723
• CVE: CVE-2009-4112
• FATE: 326485 https://features.opensuse.org/326485
• Bugzilla: 1169215 VUL-0: cacti: multiple vulnerabilities fixed and security hardening applied in 1.2.11
• Bugzilla: 1164675 VUL-0: CVE-2020-8813: cacti: remote attackers may execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege
• Bugzilla: 1161297 VUL-0: CVE-2020-7237: cacti: Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php
• Bugzilla: 1158992 VUL-0: CVE-2019-17358: cacti: Unsafe deserialization in sanitize_unserialize_selected_items
• Bugzilla: 1158990 VUL-0: CVE-2019-17357: cacti: sql injection in graphs.php
• Bugzilla: 1122535 VUL-1: CVE-2009-4112: cacti: Privilege escalation under certain conditions
• Bugzilla: 1122245 VUL-1: CVE-2018-20723: cacti: cross-site scripting (XSS) vulnerability exists in color_templates.php due to lack of escaping of unintended characters in the Name field for a Color.
• Bugzilla: 1122244 VUL-1: CVE-2018-20724: cacti: cross-site scripting (XSS) vulnerability exists in pollers.php due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.
• Bugzilla: 1122243 VUL-1: CVE-2018-20725: cacti: cross-site scripting (XSS) vulnerability exists in graph_templates.php due to lack of escaping of unintended characters in the Graph Vertical Label.
• Bugzilla: 1122242 VUL-1: CVE-2018-20726: cacti: cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti in the Website Hostname field for Devices.
• Bugzilla: 1082318 Packages must not mark license files as %doc

Packages

---

• cacti-spine-1.2.11-2.1

• cacti-1.2.11-5.1