[Pkg-cacti-maint] cacti_1.2.2+ds1-2+deb10u3_source.changes ACCEPTED into proposed-updates->stable-new

[Debian FTP Masters]

Mapping buster to stable.
Mapping stable to proposed-updates.

Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Thu, 18 Jun 2020 22:34:41 +0200
Source: cacti
Architecture: source
Version: 1.2.2+ds1-2+deb10u3
Distribution: buster
Urgency: medium
Maintainer: Cacti Maintainer <pkg-cacti-maint at lists.alioth.debian.org>
Changed-By: Paul Gevers <elbrus at debian.org>
Closes: 949996 949997
Changes:
 cacti (1.2.2+ds1-2+deb10u3) buster; urgency=medium
 .
   * Unix timestamps after Sep 13 2020 are rejected as graph start/end
     arguments (Upstream bug #3245)
   * CVE-2020-7237: Remote Code Execution (by privileged users) via shell
     metacharacters in the Performance Boost Debug Log field of
     poller_automation.php. OS commands are executed when a new poller
     cycle begins. The attacker must be authenticated, and must have access
     to modify the Performance Settings of the product. (Closes: #949997)
   * CVE-2020-7106: XSS in data_sources.php, color_templates_item.php,
     graphs.php, graph_items.php, lib/api_automation.php, user_admin.php,
     and user_group_admin.php, as demonstrated by the description parameter
     in data_sources.php (a raw string from the database that is displayed
     by $header to trigger the XSS). (Closes: #949996)
   * CVE-2020-13230: Disabling an user account does not immediately
     invalidate any permissions granted to that account (e.g., permission
     to view logs)
   * CVE-2020-13231: auth_profile.php?action=edit allows CSRF for an admin
     email change
Checksums-Sha1:
 776e1f8104f9608392149eac349892aeaa3c629c 2261 cacti_1.2.2+ds1-2+deb10u3.dsc
 7a5d661d63bc2dba0120ec874b77ddf574bcc4d6 66172 cacti_1.2.2+ds1-2+deb10u3.debian.tar.xz
Checksums-Sha256:
 b9b4889ddd6c1ca37f9f89ae53f82a19f4178cde1b4a85a439486a311d5b47cf 2261 cacti_1.2.2+ds1-2+deb10u3.dsc
 fdea59cd06101307c0f338b0c18e4db11831118a6d6c23db28fe2358b9142c52 66172 cacti_1.2.2+ds1-2+deb10u3.debian.tar.xz
Files:
 62001e04fb7ce7a1edcfbf813c59d241 2261 web optional cacti_1.2.2+ds1-2+deb10u3.dsc
 fac92e683ab5c6eb93076bb4b80c7f7c 66172 web optional cacti_1.2.2+ds1-2+deb10u3.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEWLZtSHNr6TsFLeZynFyZ6wW9dQoFAl7+NIQACgkQnFyZ6wW9
dQqvDwgApuvAT7SYNhiEpEgwxJTAI8z5oiFiEFjgVULd2O/aYboRMbnKjbYZ+xqR
RM/OmDest4SCeqtSI4KxOqnDdIANvMGd7lRufV1krZU1f626gql3TvpqJve+/YL/
ZzoDeWQHL1apH0tKpOBO/0uVonrhyhlTyI9eZ6hjRcg6u0iwpRf3f+LWH6NMFvBb
qDUGyVWXlNJ1qn40lb3DJi+4FnaxzpdcjYTdr/S4KBwpbgL4gMjxBVecM65w5yyq
33sgNEIEql7AHXbwaGixNfStSO6Barq7ygolqIbdVqvsbxMQWeg12zkP+vPU1JA4
ZjCwsw3cBk1je4DoXu2xFUqOH8pAuA==
=OyYc
-----END PGP SIGNATURE-----


Thank you for your contribution to Debian.