openSUSE-SU-2020:1060-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2020:1060-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2020:1060-1
Related
Published
2020-07-25T18:21:21Z
Modified
2020-07-25T18:21:21Z
Summary
Security update for cacti, cacti-spine
Details

This update for cacti, cacti-spine fixes the following issues:

  • cacti 1.2.13:

    • Query XSS vulnerabilities require vendor package update (CVE-2020-11022 / CVE-2020-11023)
    • Lack of escaping on some pages can lead to XSS exposure
    • Update PHPMailer to 6.1.6 (CVE-2020-13625)
    • SQL Injection vulnerability due to input validation failure when editing colors (CVE-2020-14295, boo#1173090)
    • Lack of escaping on template import can lead to XSS exposure

  • switch from cron to systemd timers (boo#1115436):

    • cacti-cron.timer
    • cacti-cron.service
  • avoid potential root escalation on systems with fs.protected_hardlinks=0 (boo#1154087): handle directory permissions in file section instead of using chown during post installation
  • rewrote apache configuration to get rid of .htaccess files and explicitely disable directory permissions per default (only allow a limited, well-known set of directories)
References

Affected packages

SUSE:Package Hub 12 / cacti

Package

Name
cacti
Purl
purl:rpm/suse/cacti&distro=SUSE%20Package%20Hub%2012

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.13-11.1

Ecosystem specific 

{
    "binaries": [
        {
            "cacti": "1.2.13-11.1",
            "cacti-spine": "1.2.13-8.1"
        }
    ]
}

SUSE:Package Hub 12 / cacti-spine

Package

Name
cacti-spine
Purl
purl:rpm/suse/cacti-spine&distro=SUSE%20Package%20Hub%2012

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.13-8.1

Ecosystem specific 

{
    "binaries": [
        {
            "cacti": "1.2.13-11.1",
            "cacti-spine": "1.2.13-8.1"
        }
    ]
}

openSUSE:Leap 15.1 / cacti

Package

Name
cacti
Purl
purl:rpm/suse/cacti&distro=openSUSE%20Leap%2015.1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.13-11.1

Ecosystem specific 

{
    "binaries": [
        {
            "cacti": "1.2.13-11.1",
            "cacti-spine": "1.2.13-8.1"
        }
    ]
}

openSUSE:Leap 15.1 / cacti-spine

Package

Name
cacti-spine
Purl
purl:rpm/suse/cacti-spine&distro=openSUSE%20Leap%2015.1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.13-8.1

Ecosystem specific 

{
    "binaries": [
        {
            "cacti": "1.2.13-11.1",
            "cacti-spine": "1.2.13-8.1"
        }
    ]
}

openSUSE:Leap 15.2 / cacti

Package

Name
cacti
Purl
purl:rpm/suse/cacti&distro=openSUSE%20Leap%2015.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.13-11.1

Ecosystem specific 

{
    "binaries": [
        {
            "cacti": "1.2.13-11.1",
            "cacti-spine": "1.2.13-8.1"
        }
    ]
}

openSUSE:Leap 15.2 / cacti-spine

Package

Name
cacti-spine
Purl
purl:rpm/suse/cacti-spine&distro=openSUSE%20Leap%2015.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.13-8.1

Ecosystem specific 

{
    "binaries": [
        {
            "cacti": "1.2.13-11.1",
            "cacti-spine": "1.2.13-8.1"
        }
    ]
}