Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.1322
[SECURITY] [DLA 1757-1] cacti security update
17 April 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: cacti
Publisher: Debian
Operating System: Debian GNU/Linux 8
Windows
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Cross-site Scripting -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2019-11025
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2019/04/msg00017.html
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running cacti check for an updated version of the software for their
operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Package : cacti
Version : 0.8.8b+dfsg-8+deb8u7
CVE ID : CVE-2019-11025
Debian Bug : #926700
It was discovered that there were a number of cross-site scripting
vulnerabilities (XSS) in cacti, a web-based front-end for the RRDTool
monitoring tool.
For Debian 8 "Jessie", this issue has been fixed in cacti version
0.8.8b+dfsg-8+deb8u7.
We recommend that you upgrade your cacti packages.
Regards,
- - --
,''`.
: :' : Chris Lamb
`. `'` lamby@debian.org / chris-lamb.co.uk
`-
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAly1ziEACgkQHpU+J9Qx
Hljdyw//VTj9vkGLDYzIzT61V4E0SEpqR4MKkIJdk3i2YW5qXvU2UgF9u4OpcW8w
QcwW5j4xB1Q36C9MR9otQgGpdIO2zGvSr5GMFtZh0klqU/hGsUO5aL0qrOfyt2/E
GWf/xmEP7wZUGTJcl7dznr50hij3b3ZZSvAXVuxym7nqZuegs3mtcPLc2Y8/AOie
GuIwPKpRZCwFz32UTX23WuAiYSnKiRIoXJqj3Y6BUdpJmEzpoc32HZ1OOVknM3xR
AQTzmMhb34OA9KlxcOcY75RFFtxUnTBiR6FOH48CmECSi8vYI0hMsG36FF72jjNc
0+TPyOH9NPm2Cr3AvPuL123CV30hIZiKqqLghV7z2YxpLmdckZuPQdzukM7IvGUp
dhe8IPDXa2dOsfpY3l656RTexZ39oi7HlLVTFM95cTnIKeAODQna7Gnoax2nQVdo
9ai/FKF3QvFwB/h3Yn48auZ9Evr6T2PwCMCLS+VPzJxxoEDJJx+wOoSKCI+6/JCL
lDZeeQ/pCtC/N8kR+lK34idpI2QwZs5arhxQw2bwaSwFFAmLSkjIMpoobyP7LV5M
1R/IhZAgQrcsgL8P6YcrbKVXPT3s/ojQ+CvCL5Ej6RbKD9yxw5TZ+UJt7hofgIgK
rvNhMJhf4LJYZmBNLF56RrQI6aBuXTPFbF+WB2PCCWpzYRt6IfU=
=p3T7
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXLaG5WaOgq3Tt24GAQisLxAAz2KlRyRVdcxiMqfkMpzFQJpHPIaATIYm
NM2AlNEMCJwTTJ/+Thk0GwUT7T3W+vqzH4F+WOohespwghKP3TiayqbEZPNeYovx
FM9xX1SdzwHAcbLjmOXvmxn+yE3PuRB+cQWaoa06uW3aRuaGY2w8Yy6GUxQlogcU
lGNmBiVNJnM/faeXZ+1kzogqar8GAurSrcXjZSEE0+toXQ+KfOF76fu8fhAQGrRc
LLaCC3qzZ3YJkFfADbxaCdSBt43+cvGvVhESfi6tncQBrjLIJ3UoTyQw4ycF5HUm
NPpwq1Y6mbfHMUKjCGxhY0ms+riNvlcjOMgic0RIqsevuPhRV+La5gKQisXXmWST
Gy+T5OWxWjgE5DkldS3N70n+xWhXZgwqmCvSGQs6ZIeNou+vj+LzrgnYQZUx2Xni
GjHm1NCDARZKMbiy0Qh4IovBlB6Fgc0++wTvQcQRl7BmL/mgAjuR9Riw++cL5H8P
mIcV7zF82Nlvzk6N51Egnkta/6oKjauUhYgQaHw73Lj4GH+O5xhSvsQx0yG8WBwD
ZwNgSrf+mxcwG5XCETwnKXiXF3xwaZQJM0gMANm/p5VzpU1WXxbCcDoaXJpXQYgc
4i/K3UhdumfIlBORCXl2Zpy/8hO44xXB5BUhCbUv+FjISopXKHsy4FTL+V86RQbt
PpNvm0jA49Y=
=gNL+
-----END PGP SIGNATURE-----