{"id":"openSUSE-SU-2023:0275-1","summary":"Security update for cacti, cacti-spine","details":"This update for cacti, cacti-spine fixes the following issues:\n\ncacti-spine 1.2.25:\n\n* Spine should see if script to be executed is executable\n* Enhance number recognition\n* When polling devices, sort by larger number of items first\n* Log format may be corrupted when timeout occurs\n* Compile warning appears due to GCC flag on RHEL7/RHEL8\n* Downed device detection only checks one of the two uptime OIDs\n* Compile error appears due to execinfo.h on FreeBSD\n* Bootstrap shell script contains some PHP cruft\n* Padding is not always removed from the start of non-numeric strings\n* Improve SNMP result handling for non-numeric results\n* Further improve SNMP result handling for non-numeric results\n* Remove check for the max_oids column which has been present since Cacti v1.0\n* Minimize Sorting when fetching poller records for maximum performance\n* Spine should see if script to be executed is executable\n\ncacti-spine 1.2.24:\n\n* Fix segfault when ignoring older OIDs\n\ncacti 1.2.25:\n\n* CVE-2023-30534: Protect against Insecure deserialization of filter data (boo#1215082)\n* CVE-2023-39360: Cross-Site Scripting vulnerability when creating new graphs (boo#1215044)\n* CVE-2023-39361: Unauthenticated SQL Injection when viewing graphs (boo#1215045)\n* CVE-2023-39357: SQL Injection when saving data with sql_save() (boo#1215040)\n* CVE-2023-39362: Authenticated command injection when using SNMP options (boo#1215047)\n* CVE-2023-39359: Authenticated SQL injection vulnerability when managing graphs (boo#1215043)\n* CVE-2023-39358: Authenticated SQL injection vulnerability when managing reports (boo#1215042)\n* CVE-2023-39365: SQL Injection when using regular expressions (boo#1215051)\n* CVE-2023-39364: redirect in change password functionality (boo#1215050)\n* CVE-2023-39366: Cross-Site Scripting vulnerability with Device Name when managing Data Sources (boo#1215052)\n* CVE-2023-39510: Cross-Site Scripting vulnerability with Device Name when administrating Reports (boo#1215053)\n* CVE-2023-39511: Cross-Site Scripting vulnerability with Device Name when editing Graphs whilst managing Reports (boo#1215081)\n* CVE-2023-39512: Cross-Site Scripting vulnerability with Device Name when managing Data Sources (boo#1215054)\n* CVE-2023-39513: Cross-Site Scripting vulnerability with Device Name when debugging data queries (boo#1215055)\n* CVE-2023-39514: Cross-Site Scripting vulnerability with Data Source Name when managing Graphs (boo#1215056)\n* CVE-2023-39515: Cross-Site Scripting vulnerability with Data Source Name when debugging Data Queries (boo#1215058)\n* CVE-2023-39516: Cross-Site Scripting vulnerability with Data Source Information when managing Data Sources (boo#1215059)\n* When rebuilding the Poller Cache from command line, allow it to be multi-threaded\n* When searching tree or list views, the URL does not update after changes\n* When creating a Data Source Template with a specific snmp port, the port is not always applied\n* When a Data Query references a file, the filename should be trimmed to remove spurious spaces\n* THold plugin may not always install or upgrade properly\n* RRD file structures are not always updated properly, if there are more Data Sources in the Data Template than the Graph Template\n* When reindexing devices, errors may sometimes be shown\n* Boost may loose data when the database server is overloaded\n* Boost can sometimes output unexpected or invalid values\n* Boost should not attempt to start if there are no items to process\n* Rebuilding the poller cache does not always work as expected\n* Host CPU items may not work poll as expected when on a remote data collector where hmib is also enabled\n* When creating new graphs, invalid offset errors may be generated\n* When importing packages, SQL errors may be generated\n* When managing plugins from command line, the --plugin option is not properly handled\n* When automating an install of Cacti, error messages can be appear\n* When performing automated install of a plugin, warnings can be thrown\n* Automation references the wrong table name causing errors\n* Data Source Info Mode produces invalid recommendations\n* Data Source Debug 'Run All' generates too many log messages\n* The description of rebuild poller cache in utilities does not display properly\n* When reindexing a device, debug information may not always display properly\n* Upon displaying a form with errors, the session error fields variable isn't cleared\n* MariaDB clusters will no longer support exclusive locks\n* RRDtool can fail to update when sources in Data Template and Graph Template data sources do not match\n* Compatibility improvements for Boost under PHP 8.x\n* When searching the tree, increase the time before querying for items\n* Device Location drop down does not always populate correctly\n* When viewing Realtime graphs, undefined variable errors may be reported\n* SNMP Uptime is not always ignored for spikekills\n* Improve detection of downed Devices\n* When reporting missing functions from Plugins, ensure messages do not occur too often\n* When starting the Cacti daemon, database errors may be reported when there is no problem\n* When reporting from RRDcheck, ensure prefix is in the correct casing\n* Improve Orphaned Data Source options and display\n* Parsing the PHP Configuration may sometimes produce errors\n* Security processes attempt to check for a user lockout even if there is no user logged in\n* When attempting to edit a tree, the search filter for Graphs remains disabled\n* When reindexing, a Data Source that could be un-orphaned may not always be unorphaned\n* When parsing a date value, there could be more than 30 chars\n* Untemplated Data Sources can fail to update due to lack of an assigned Graph\n* When processing items to check, do not include disabled hosts\n* When saving a Data Source Template, SQL errors may be reported\n* When importing a Template, errors may be recorded\n* Some display strings have invalid formatting that cannot be parsed\n* When filtering with regular expressions, the 'does not match' option does not always function as expected\n* When enabling a plugin, sometimes it can appear as if nothing happens\n* Ensure the Rows Per Page option shows limitations set by configuration\n* Plugins are unable to modify fields in the setting 'Change Device Settings'\n* When reporting emails being sent, ensure BCC addresses are also included\n* Improve compatibility of SNMP class trim handling under PHP 8.x\n* When importing legacy Data Query Templates, the Template can become unusable\n* Provide ability to raise an event when extending the settings form\n* Prevent unsupported SQL Mode flags from being set\n* The DSStats summary does not always display expected values\n* When performing a fresh install, device classification may be missing.\n* Duplication functions for Graph/Template and Data Source/Template do not return and id\n* Duplication of Device Templates should be an API call\n* Unable to convert database to latin1 instead of utf8 if desired\n* When creating Graphs, the process may become slower over time as more items exist\n* When a bulk walk size is set to automatic, this is not always set to the optimal value\n* Update copyright notice on import packages\n* When viewing Orphan Graphs, SQL errors may be reported\n* When reindexing hosts from command line, ensure only one process runs at once\n* When a Data Query has no Graphs, it may not be deletable\n* When duplicating a Graph Template, provide an option to not duplicate Data Query association\n* When duplicating a Data Template errors can appear in the Cacti log\n* When importing a Package, previewing makes unexpected changes to Cacti Templates\n* When enabling boost on a fresh install, an error may be reported\n* Improve compatibility for backtrace logging under PHP 8.x\n* Improve compatibility for Advanced Ping under PHP 8.x\n* Provide new templates for Fortigate and Aruba Cluster to be available during install\n* Provide new template for SNMP Printer to be available during install\n* When importing devices, allow a device classification to be known\n* Extend length of maximum name in settings table\n* Extend length of maximum name in user settings table\n* Data Queries do not have a Duplication function\n* Upgrade d3.js v7.8.2 and billboard.js v3.7.4\n* Upgrade ua-parser.js to version 1.0.35\n* Update Cisco Device Template to include HSRP graph template\n* New hook for device template change 'device_template_change'\n\ncacti 1.2.24\n\n* Fix: Unable to import Local Linux Machine template\n* Fix multiple charting and display issues\n* Compatibility changes for SNMP under PHP 8.2, and other PHP\n  compatibility updates\n* Fix multiple issues editing settings\n* timeout fixes for Basic Auth\n* multiple data poller bug fixes\n","modified":"2026-03-11T07:33:39.846919Z","published":"2023-09-26T13:31:33Z","related":["CVE-2023-30534","CVE-2023-39357","CVE-2023-39358","CVE-2023-39359","CVE-2023-39360","CVE-2023-39361","CVE-2023-39362","CVE-2023-39364","CVE-2023-39365","CVE-2023-39366","CVE-2023-39510","CVE-2023-39511","CVE-2023-39512","CVE-2023-39513","CVE-2023-39514","CVE-2023-39515","CVE-2023-39516"],"upstream":["CVE-2023-30534","CVE-2023-39357","CVE-2023-39358","CVE-2023-39359","CVE-2023-39360","CVE-2023-39361","CVE-2023-39362","CVE-2023-39364","CVE-2023-39365","CVE-2023-39366","CVE-2023-39510","CVE-2023-39511","CVE-2023-39512","CVE-2023-39513","CVE-2023-39514","CVE-2023-39515","CVE-2023-39516"],"references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JFJCU2NOOFCO7XJZOUW2BQ6HWJMHSYSN/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1215040"},{"type":"REPORT","url":"https://bugzilla.suse.com/1215042"},{"type":"REPORT","url":"https://bugzilla.suse.com/1215043"},{"type":"REPORT","url":"https://bugzilla.suse.com/1215044"},{"type":"REPORT","url":"https://bugzilla.suse.com/1215045"},{"type":"REPORT","url":"https://bugzilla.suse.com/1215047"},{"type":"REPORT","url":"https://bugzilla.suse.com/1215050"},{"type":"REPORT","url":"https://bugzilla.suse.com/1215051"},{"type":"REPORT","url":"https://bugzilla.suse.com/1215052"},{"type":"REPORT","url":"https://bugzilla.suse.com/1215053"},{"type":"REPORT","url":"https://bugzilla.suse.com/1215054"},{"type":"REPORT","url":"https://bugzilla.suse.com/1215055"},{"type":"REPORT","url":"https://bugzilla.suse.com/1215056"},{"type":"REPORT","url":"https://bugzilla.suse.com/1215058"},{"type":"REPORT","url":"https://bugzilla.suse.com/1215059"},{"type":"REPORT","url":"https://bugzilla.suse.com/1215081"},{"type":"REPORT","url":"https://bugzilla.suse.com/1215082"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-30534"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-39357"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-39358"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-39359"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-39360"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-39361"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-39362"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-39364"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-39365"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-39366"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-39510"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-39511"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-39512"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-39513"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-39514"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-39515"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-39516"}],"affected":[{"package":{"name":"cacti","ecosystem":"SUSE:Package Hub 12","purl":"pkg:rpm/suse/cacti&distro=SUSE%20Package%20Hub%2012"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-bp155.2.3.1"}]}],"ecosystem_specific":{"binaries":[{"cacti-spine":"1.2.25-bp155.2.3.1","cacti":"1.2.25-bp155.2.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2023:0275-1.json"}},{"package":{"name":"cacti-spine","ecosystem":"SUSE:Package Hub 12","purl":"pkg:rpm/suse/cacti-spine&distro=SUSE%20Package%20Hub%2012"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-bp155.2.3.1"}]}],"ecosystem_specific":{"binaries":[{"cacti-spine":"1.2.25-bp155.2.3.1","cacti":"1.2.25-bp155.2.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2023:0275-1.json"}},{"package":{"name":"cacti","ecosystem":"SUSE:Package Hub 15 SP4","purl":"pkg:rpm/suse/cacti&distro=SUSE%20Package%20Hub%2015%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-bp155.2.3.1"}]}],"ecosystem_specific":{"binaries":[{"cacti-spine":"1.2.25-bp155.2.3.1","cacti":"1.2.25-bp155.2.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2023:0275-1.json"}},{"package":{"name":"cacti-spine","ecosystem":"SUSE:Package Hub 15 SP4","purl":"pkg:rpm/suse/cacti-spine&distro=SUSE%20Package%20Hub%2015%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-bp155.2.3.1"}]}],"ecosystem_specific":{"binaries":[{"cacti-spine":"1.2.25-bp155.2.3.1","cacti":"1.2.25-bp155.2.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2023:0275-1.json"}},{"package":{"name":"cacti","ecosystem":"SUSE:Package Hub 15 SP5","purl":"pkg:rpm/suse/cacti&distro=SUSE%20Package%20Hub%2015%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-bp155.2.3.1"}]}],"ecosystem_specific":{"binaries":[{"cacti":"1.2.25-bp155.2.3.1","cacti-spine":"1.2.25-bp155.2.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2023:0275-1.json"}},{"package":{"name":"cacti-spine","ecosystem":"SUSE:Package Hub 15 SP5","purl":"pkg:rpm/suse/cacti-spine&distro=SUSE%20Package%20Hub%2015%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-bp155.2.3.1"}]}],"ecosystem_specific":{"binaries":[{"cacti-spine":"1.2.25-bp155.2.3.1","cacti":"1.2.25-bp155.2.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2023:0275-1.json"}},{"package":{"name":"cacti","ecosystem":"openSUSE:Leap 15.4","purl":"pkg:rpm/opensuse/cacti&distro=openSUSE%20Leap%2015.4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-bp155.2.3.1"}]}],"ecosystem_specific":{"binaries":[{"cacti-spine":"1.2.25-bp155.2.3.1","cacti":"1.2.25-bp155.2.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2023:0275-1.json"}},{"package":{"name":"cacti-spine","ecosystem":"openSUSE:Leap 15.4","purl":"pkg:rpm/opensuse/cacti-spine&distro=openSUSE%20Leap%2015.4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-bp155.2.3.1"}]}],"ecosystem_specific":{"binaries":[{"cacti-spine":"1.2.25-bp155.2.3.1","cacti":"1.2.25-bp155.2.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2023:0275-1.json"}},{"package":{"name":"cacti","ecosystem":"openSUSE:Leap 15.5","purl":"pkg:rpm/opensuse/cacti&distro=openSUSE%20Leap%2015.5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-bp155.2.3.1"}]}],"ecosystem_specific":{"binaries":[{"cacti-spine":"1.2.25-bp155.2.3.1","cacti":"1.2.25-bp155.2.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2023:0275-1.json"}},{"package":{"name":"cacti-spine","ecosystem":"openSUSE:Leap 15.5","purl":"pkg:rpm/opensuse/cacti-spine&distro=openSUSE%20Leap%2015.5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.25-bp155.2.3.1"}]}],"ecosystem_specific":{"binaries":[{"cacti-spine":"1.2.25-bp155.2.3.1","cacti":"1.2.25-bp155.2.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2023:0275-1.json"}}],"schema_version":"1.7.5"}