File _patchinfo of Package patchinfo.12027

<patchinfo incident="12027">
  <issue tracker="fate" id="326485"/>
  <issue tracker="cve" id="2019-17357"/>
  <issue tracker="cve" id="2020-7237"/>
  <issue tracker="cve" id="2019-17358"/>
  <issue tracker="cve" id="2009-4112"/>
  <issue tracker="cve" id="2018-20725"/>
  <issue tracker="cve" id="2018-20723"/>
  <issue tracker="cve" id="2018-20726"/>
  <issue tracker="cve" id="2018-20724"/>
  <issue tracker="cve" id="2020-7106"/>
  <issue tracker="cve" id="2019-16723"/>
  <issue tracker="bnc" id="1101139">cacti.conf Apache Invalid command 'Order'</issue>
  <issue tracker="bnc" id="1161297">VUL-0: CVE-2020-7237: cacti: Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php</issue>
  <issue tracker="bnc" id="1158992">VUL-0: CVE-2019-17358: cacti: Unsafe deserialization in sanitize_unserialize_selected_items</issue>
  <issue tracker="bnc" id="1122535">VUL-1: CVE-2009-4112: cacti: Privilege escalation under certain conditions</issue>
  <issue tracker="bnc" id="1122244">VUL-1: CVE-2018-20724: cacti: cross-site scripting (XSS) vulnerability exists in pollers.php due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.</issue>
  <issue tracker="bnc" id="1122243">VUL-1: CVE-2018-20725: cacti: cross-site scripting (XSS) vulnerability exists in graph_templates.php due to lack of escaping of unintended characters in the Graph Vertical Label.</issue>
  <issue tracker="bnc" id="1122242">VUL-1: CVE-2018-20726: cacti: cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti in the Website Hostname field for Devices.</issue>
  <issue tracker="bnc" id="1101024">missing php packages in cacti.spec</issue>
  <issue tracker="bnc" id="1158990">VUL-0: CVE-2019-17357: cacti: sql injection in graphs.php</issue>
  <issue tracker="bnc" id="1082318">Packages must not mark license files as %doc</issue>
  <issue tracker="bnc" id="1122245">VUL-1: CVE-2018-20723: cacti: cross-site scripting (XSS) vulnerability exists in color_templates.php due to lack of escaping of unintended characters in the Name field for a Color.</issue>
  <issue tracker="bnc" id="1163749">VUL-0: CVE-2020-7106: cacti: Lack of escaping on some pages can lead to XSS exposure</issue>
  <packager>AndreasStieger</packager>
  <rating>important</rating>
  <category>security</category>
  <summary>Security update for cacti, cacti-spine</summary>
  <description>This update for cacti, cacti-spine fixes the following issues:

cacti-spine was updated to version 1.2.9.


Security issues fixed:

- CVE-2009-4112: Fixed a privilege escalation (bsc#1122535).
- CVE-2018-20723: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122245).
- CVE-2018-20724: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122244).
- CVE-2018-20725: Fixed a privilege escalation that could occur under certain conditions (bsc#1122535).
- CVE-2018-20726: Fixed a cross-site scripting (XSS) vulnerability (bsc#1122242).
- CVE-2019-16723: Fixed an authentication bypass vulnerability.
- CVE-2019-17357: Fixed an SQL injection vulnerability (bsc#1158990).
- CVE-2019-17358: Fixed an unsafe deserialization in sanitize_unserialize_selected_items (bsc#1158992).
- CVE-2020-7106: Fixed a potential cross-site scripting (XSS) vulnerability (bsc#1163749).
- CVE-2020-7237: Fixed a remote code execution that affected privileged users via shell metacharacters in the Performance Boost Debug Log field (bsc#1161297).


Non-security issues fixed:

- Fixed missing packages php-json, php-ctype, and php-gd in cacti.spec (boo#1101024).
- Fixed Apache2.4 and Apache2.2 runtime configuration issue (boo#1101139).
</description>
</patchinfo>