[Pkg-cacti-maint] cacti_1.1.27+ds1-3_source.changes ACCEPTED into unstable

[Debian FTP Masters]

Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Tue, 14 Nov 2017 20:14:34 +0100
Source: cacti
Binary: cacti
Architecture: source
Version: 1.1.27+ds1-3
Distribution: unstable
Urgency: medium
Maintainer: Cacti Maintainer <pkg-cacti-maint at lists.alioth.debian.org>
Changed-By: Paul Gevers <elbrus at debian.org>
Description:
 cacti      - web interface for graphing of monitoring systems
Closes: 881110
Changes:
 cacti (1.1.27+ds1-3) unstable; urgency=medium
 .
   * CVE-2017-16641: remote authenticated administrators can execute
     arbitrary os commands via the path_rrdtool parameter in an action=save
     request to settings.php (Closes: #881110)
   * CVE-2017-16660: remote authenticated administrators can conduct Remote
     Code Execution attacks by placing the Log Path under the web root, and
     then making a remote_agent.php request containing PHP code in a
     Client-ip header
   * CVE-2017-16661: remote authenticated administrators can read arbitrary
     files accessible by the web-server user by placing the Log Path into a
     private directory, and then making a clog.php?filename= request
   * CVE-2017-16785: reflected XSS via the PATH_INFO to host.php
     (reintroduction of CVE-2017-15194)
   * Bump standards to 4.1.1
   * Set Priority to optional
Checksums-Sha1:
 6da0c05e6b24552f8e3f4c0d995152531237f5e1 2134 cacti_1.1.27+ds1-3.dsc
 e0d1f509fb465f2c1676b254fc0d5b1362e9f7f5 56092 cacti_1.1.27+ds1-3.debian.tar.xz
Checksums-Sha256:
 9d77784c2545398d29f325c99764b1aebeb8966bb7d12e5c0dda78e7673306f3 2134 cacti_1.1.27+ds1-3.dsc
 519db95eb5fd254f309faad31aaeb2d79fa1b2bbe8a8c604aa8b8fdcc7203f44 56092 cacti_1.1.27+ds1-3.debian.tar.xz
Files:
 2f7335b2759d8227a2b170074abf98de 2134 web optional cacti_1.1.27+ds1-3.dsc
 fd6375c1fc789d1654364421b949f5ac 56092 web optional cacti_1.1.27+ds1-3.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEWLZtSHNr6TsFLeZynFyZ6wW9dQoFAloLTQwACgkQnFyZ6wW9
dQpdEQgArlYK+cTh13PDHWpBbVGsg2TSH6vkIPQXUbM10uTcKHvgbd+vF83tYoh2
PQ+KHUImJhDc0Kd6bVfk9TixKG0KAm3FQ4sMleNCtQugoDKeR1qPadEbXlZB1GNp
AqgAUvYfWWPF1u4bi/ZCB+WJULOeiU8J2WNCa64ppbSUpQLy2JD9kHaRuypYw3YQ
8KkC0eY7dTsaDzpjkQOYjZLXKiivvTRDh3oUYJ88mPJDcXIziC2a6in4lWUcQyho
/fker79akY1cL6KDKoOdff8iq86V1h9WD9aLWetZu/SEw96ysWHHvu0fmM9IJmHa
uEs97E9RHMxHHnsik8P970Z1cxUwag==
=x3y5
-----END PGP SIGNATURE-----


Thank you for your contribution to Debian.