CVE-2022-0730

Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types.

Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types.

This update for cacti, cacti-spine fixes the following issues:

cacti-spine was updated to 1.2.20:

• Add support for newer versions of MySQL/MariaDB
• When checking for uptime of device, don't assume a non-response is always fatal
• Fix description and command trunctation issues
• Improve spine performance when only one snmp agent port is in use

cacti-spine 1.2.19:

• Fix 1ssues with polling loop may skip some datasources
• Fix ping no longer works due to hostname changes
• Fix RRD steps are not always calculated correctly
• Fix unable to build when DES no longer supported
• Fix IPv6 devices are not properly parsed
• Reduce a number of compiler warnings
• Fix compiler warnings due to lack of return in thread_mutex_trylock
• Fix Spine will not look at non-timetics uptime when sysUpTimeInstance overflows
• Improve performance of Cacti poller on heavily loaded systems

cacti-spine 1.2.20:

• Add support for newer versions of MySQL/MariaDB
• When checking for uptime of device, don't assume a non-response is always fatal
• Fix description and command trunctation issues
• Improve spine performance when only one snmp agent port is in use

cacti was updated to 1.2.20:

• Security fix for CVE-2022-0730, boo#1196692 Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types.
• Security fix: Device, Graph, Graph Template, and Graph Items may be vulnerable to XSS issues
• Security fix: Lockout policies are not properly applied to LDAP and Domain Users
• Security fix: When using 'remember me' option, incorrect realm may be selected
• Security fix: User and Group maintenance are vulnerable to SQL attacks
• Security fix: Color Templates are vulnerable to XSS attack
• Features:
  • When creating a Data Source Profile, allow additional choices for Heartbeat
  • Change select all options to use Font Awesome icons
  • Improve spine performance by storing the total number of system snmp_ports in use
  • Prevent Template User Accounts from being Removed
  • When managing by users, allow filtering by Realm
  • Allow plugins to supply template account names
  • When viewing logs, additional message types should be filterable
  • When creating a Graph Template Item, allow filtering by Data Template
  • Allow language handler to be selected via UI
  • Updated Device packages for Synology, Citrix NetScaler, Cisco ASA/Cisco
  • Add Advanced Ping Graph Template to initial Installable templates
  • Add LDAP Debug Mode option
  • Allow Reports to include devices not on a Tree
  • Allow Basic Authentication to display custom failure message
• Fix: When replicating data during installation/upgrade, system may appear to hang
• Fix: Graph Template Items may have duplicated entries
• Fix: Unable to Save Graph Settings
• Fix: Script Server may crash if an OID is missing or unavailable
• Fix: When system-wide polling is disabled, remote pollers may fail to sync changed settings
• Fix: When updating poller name, duplicate name protection may be over zealous
• Fix: Titles may show 'Missing Datasource' incorectly
• Fix: Checking for MIB Cache can cause crashes
• Fix: Polling cycles may not always complete as expected
• Fix: When viewing graph data, non-numeric values may appear
• Fix: Utilities view has calculation errors when there are no data sources
• Fix: When editing Reports, drag and drop may not function as intended
• Fix: When data drive is full, viewing a Graph can result in errors
• Various other bug fixes

cacti 1.2.19:

• Further fixes for grave character security protection (boo#1192408)
• Fix Over aggressive escaping causing menu visibility issues on Create Device page
• Add SHA256 and AES256 security levels for SNMP polling
• Import graph template(Preview Only) show color_id new value as a blank area
• Fix Editing graphs errors due to missing sequence *…

These are all security issues fixed in the cacti-1.2.20-1.1 package on the GA media of openSUSE Tumbleweed.