openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0031-1 Rating: important References: #1218360 #1218366 #1218378 #1218379 #1218380 #1218381 Cross-References: CVE-2023-49084 CVE-2023-49085 CVE-2023-49086 CVE-2023-49088 CVE-2023-50250 CVE-2023-51448 CVSS scores: CVE-2023-49084 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-49085 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-49086 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2023-49088 (NVD) : 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVE-2023-50250 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2023-51448 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.26: * Fix: Errors when uptime OID is not present * Fix: MySQL reconnect option is depreciated * Fix: Spine does not check a host with no poller items * Fix: Poller may report the wrong number of devices polled * Feature: Allow users to override the threads setting at the command line * Feature: Allow spine to run in ping-only mode cacti 1.2.26: * CVE-2023-50250: XSS vulnerability when importing a template file (boo#1218380) * CVE-2023-49084: RCE vulnerability when managing links (boo#1218360) * CVE-2023-49085: SQL Injection vulnerability when managing poller devices (boo#1218378) * CVE-2023-49086: XSS vulnerability when adding new devices (boo#1218366) * CVE-2023-49088: XSS vulnerability when viewing data sources in debug mode (boo#1218379) * CVE-2023-51448: SQL Injection vulnerability when managing SNMP Notification Receivers (boo#1218381) * When viewing data sources, an undefined variable error may be seen * Improvements for Poller Last Run Date * Attempting to edit a Data Query that does not exist throws warnings and not an GUI error * Improve PHP 8.1 support when adding devices * Viewing Data Query Cache can cause errors to be logged * Preserve option is not properly honoured when removing devices at command line * Infinite recursion is possible during a database failure * Monitoring Host CPU's does not always work on Windows endpoints * Multi select drop down list box not rendered correctly in Chrome and Edge * Selective Plugin Debugging may not always work as intended * During upgrades, Plugins may be falsely reported as incompatible * Plugin management at command line does not work with multiple plugins * Improve PHP 8.1 support for incrementing only numbers * Allow the renaming of guest and template accounts * DS Stats issues warnings when the RRDfile has not been initialized * When upgrading, missing data source profile can cause errors to be logged * When deleting a single Data Source, purge historical debug data * Improvements to form element warnings * Some interface aliases do not appear correctly * Aggregate graph does not show other percentiles * Settings table updates for large values reverted by database repair * When obtaining graph records, error messages may be recorded * Unable to change a device's community at command line * Increase timeout for RRDChecker * When viewing a graph, option to edit template may lead to incorrect URL * When upgrading, failures may occur due to missing color table keys * On installation, allow a more appropriate template to be used as the default * When data input parameters are allowed to be null, allow null * CSV Exports may not always output data correctly * When debugging a graph, long CDEF's can cause undesirable scrolling * Secondary LDAP server not evaluated when the first one has failed * When adding a device, using the bulk walk option can make version information appear * When parsing a Data Query resource, an error can be reported if no direction is specified * Database reconnection can cause errors to be reported incorrectly * fix returned value if $sau is empty * Add Aruba switch, Aruba controller and HPE iLO templates * Add OSCX 6x00 templates Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2024-31=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.26-32.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.2.26-38.1 References: https://www.suse.com/security/cve/CVE-2023-49084.html https://www.suse.com/security/cve/CVE-2023-49085.html https://www.suse.com/security/cve/CVE-2023-49086.html https://www.suse.com/security/cve/CVE-2023-49088.html https://www.suse.com/security/cve/CVE-2023-50250.html https://www.suse.com/security/cve/CVE-2023-51448.html https://bugzilla.suse.com/1218360 https://bugzilla.suse.com/1218366 https://bugzilla.suse.com/1218378 https://bugzilla.suse.com/1218379 https://bugzilla.suse.com/1218380 https://bugzilla.suse.com/1218381