Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bugzilla DB migration completed. Please report issues to Infra team via email via infra@gentoo.org or IRC
Bug 702312 (CVE-2019-16723, CVE-2019-17357, CVE-2019-17358) - <net-analyzer/cacti-1.2.8: multiple vulnerabilities
Summary: <net-analyzer/cacti-1.2.8: multiple vulnerabilities
Status: RESOLVED FIXED
Alias: CVE-2019-16723, CVE-2019-17357, CVE-2019-17358
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [glsa+ cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2019-12-08 23:35 UTC by Jeroen Roovers
Modified: 2020-03-19 16:31 UTC (History)
2 users (show)

See Also:
Package list:
=net-analyzer/cacti-1.2.8 =net-analyzer/cacti-spine-1.2.8
Runtime testing required: ---
stable-bot: sanity-check+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jeroen Roovers gentoo-dev 2019-12-08 23:35:59 UTC
-security#3025: CVE-2019-17357 When viewing graphs, some input variables are not properly checked (SQL injection possible)
-security#3026: CVE-2019-17358 When deserializating data, ensure basic sanitization has been performed
-security#3066: When using HTTPS, secure cookie to prevent potential weakness
Comment 1 Larry the Git Cow gentoo-dev 2019-12-08 23:37:48 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3db69bfbad40a7f2358e4727e665a119c675b54c

commit 3db69bfbad40a7f2358e4727e665a119c675b54c
Author:     Jeroen Roovers <jer@gentoo.org>
AuthorDate: 2019-12-08 23:36:53 +0000
Commit:     Jeroen Roovers <jer@gentoo.org>
CommitDate: 2019-12-08 23:37:44 +0000

    net-analyzer/cacti: Version 1.2.8
    
    Package-Manager: Portage-2.3.81, Repoman-2.3.20
    Bug: https://bugs.gentoo.org/702312
    Signed-off-by: Jeroen Roovers <jer@gentoo.org>

 net-analyzer/cacti/Manifest           |  1 +
 net-analyzer/cacti/cacti-1.2.8.ebuild | 48 +++++++++++++++++++++++++++++++++++
 2 files changed, 49 insertions(+)
Comment 2 Tomasz Chilinski 2019-12-10 07:50:38 UTC
These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild  NS   ~] net-analyzer/cacti-1.2.8:1.2.8::gentoo [1.2.7:1.2.7::gentoo] USE="snmp vhosts -doc" 24,298 KiB
[ebuild     U ~] net-analyzer/cacti-spine-1.2.8::gentoo [1.2.7::gentoo] USE="-libressl" 105 KiB

Total: 2 packages (1 upgrade, 1 in new slot), Size of downloads: 24,403 KiB


>>> Verifying ebuild manifests

>>> Emerging (1 of 2) net-analyzer/cacti-1.2.8::gentoo
 * Fetching files in the background.
 * To view fetch progress, run in another terminal:
 * tail -f /var/log/emerge-fetch.log
>>> Downloading 'http://distfiles.gentoo.org/distfiles/3f/cacti-1.2.8.tar.gz'
--2019-12-10 08:50:09--  http://distfiles.gentoo.org/distfiles/3f/cacti-1.2.8.tar.gz
Resolving distfiles.gentoo.org... 140.211.166.134, 64.50.233.100, 64.50.236.52, ...
Connecting to distfiles.gentoo.org|140.211.166.134|:80... connected.
HTTP request sent, awaiting response... 404 Not Found
2019-12-10 08:50:10 ERROR 404: Not Found.

>>> Downloading 'https://www.cacti.net/downloads/cacti-1.2.8.tar.gz'
--2019-12-10 08:50:10--  https://www.cacti.net/downloads/cacti-1.2.8.tar.gz
Resolving www.cacti.net... 104.28.9.127, 104.28.8.127, 2606:4700:30::681c:97f, ...
Connecting to www.cacti.net|104.28.9.127|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 24881361 (24M) [application/octet-stream]
Saving to: ‘/usr/portage/distfiles/cacti-1.2.8.tar.gz.__download__’

/usr/portage/distfi 100%[===================>]  23.73M  3.15MB/s    in 8.6s    

2019-12-10 08:50:19 (2.77 MB/s) - ‘/usr/portage/distfiles/cacti-1.2.8.tar.gz.__download__’ saved [24881361/24881361]

!!! Fetched file: cacti-1.2.8.tar.gz VERIFY FAILED!
!!! Reason: Filesize does not match recorded size
!!! Got:      24881361
!!! Expected: 24881030
Refetching... File renamed to '/usr/portage/distfiles/cacti-1.2.8.tar.gz._checksum_failure_.v853zg01'

!!! Couldn't download 'cacti-1.2.8.tar.gz'. Aborting.
 * Fetch failed for 'net-analyzer/cacti-1.2.8', Log file:
 *  '/var/tmp/portage/net-analyzer/cacti-1.2.8/temp/build.log'

>>> Failed to emerge net-analyzer/cacti-1.2.8, Log file:

>>>  '/var/tmp/portage/net-analyzer/cacti-1.2.8/temp/build.log'

 * Messages for package net-analyzer/cacti-1.2.8:

 * Fetch failed for 'net-analyzer/cacti-1.2.8', Log file:
 *  '/var/tmp/portage/net-analyzer/cacti-1.2.8/temp/build.log'
Comment 3 Larry the Git Cow gentoo-dev 2019-12-10 09:00:33 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e7568c36bf5de877b7c84b00e6abe3cd1a61cd7b

commit e7568c36bf5de877b7c84b00e6abe3cd1a61cd7b
Author:     Jeroen Roovers <jer@gentoo.org>
AuthorDate: 2019-12-10 08:59:17 +0000
Commit:     Jeroen Roovers <jer@gentoo.org>
CommitDate: 2019-12-10 09:00:30 +0000

    net-analyzer/cacti: Fix Manifest for re-uploaded tarball
    
    Package-Manager: Portage-2.3.81, Repoman-2.3.20
    Bug: https://bugs.gentoo.org/show_bug.cgi?id=702312
    Signed-off-by: Jeroen Roovers <jer@gentoo.org>

 net-analyzer/cacti/Manifest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 4 Larry the Git Cow gentoo-dev 2019-12-10 09:03:11 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=efef86609255871ca9573c7c48e0410633ad4910

commit efef86609255871ca9573c7c48e0410633ad4910
Author:     Jeroen Roovers <jer@gentoo.org>
AuthorDate: 2019-12-10 09:02:46 +0000
Commit:     Jeroen Roovers <jer@gentoo.org>
CommitDate: 2019-12-10 09:03:07 +0000

    net-analyzer/cacti-spine: Fix Manifest for re-uploaded tarball
    
    Package-Manager: Portage-2.3.81, Repoman-2.3.20
    Bug: https://bugs.gentoo.org/show_bug.cgi?id=702312
    Signed-off-by: Jeroen Roovers <jer@gentoo.org>

 net-analyzer/cacti-spine/Manifest | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 5 Agostino Sarubbo gentoo-dev 2019-12-10 10:33:10 UTC
sparc stable
Comment 6 Agostino Sarubbo gentoo-dev 2019-12-11 10:47:42 UTC
amd64 stable
Comment 7 Thomas Deutschmann gentoo-dev Security 2019-12-13 00:08:38 UTC
x86 stable
Comment 8 Jeroen Roovers gentoo-dev 2019-12-14 09:38:05 UTC
Stable for HPPA.
Comment 9 Thomas Deutschmann gentoo-dev Security 2020-03-19 16:26:03 UTC
Added to an existing GLSA.
Comment 10 GLSAMaker/CVETool Bot gentoo-dev 2020-03-19 16:31:05 UTC
This issue was resolved and addressed in
 GLSA 202003-40 at https://security.gentoo.org/glsa/202003-40
by GLSA coordinator Thomas Deutschmann (whissi).