mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-23 03:27:02 +09:00
security: batch 5 develop - fail closed on No-Auth admin bypass (GHSA-69vw), tag GHSA-3jj2, add 1.2.32 CHANGELOG section (#8146)
* security(GHSA-69vw): fail closed on auth_method None instead of auto-granting an admin session - check_reset_no_authentication() no longer wipes the admin password, flips auth_method, or hands an unauthenticated request an admin session; it fails closed and requires a manual auth_method reset (GHSA-69vw-qxxv-p8w2). - Tag GHSA-3jj2-v5ch-wmq5 in the CHANGELOG: the domains_login_process() realm bypass is already closed by the Login Providers rewrite (realm < 1000 fails closed). - CHANGELOG: add a 1.2.32 section below 1.3.0-dev with the GHSAs also fixed in 1.2.x, and de-duplicate the security entries the #8145 merge doubled. * docs(CHANGELOG): file host_id SQLi fix under 1.2.31 as GHSA-r7hc-hrpv-52gf; drop plain issue#7693 entry
This commit is contained in:
TheWitness authored and GitHub committed
1 parent
41e6d9e033
commit
9d628b4959
4 files changed
+98
-103
No files matched your search
@@ -1,42 +1,15 @@
|
||||
Cacti CHANGELOG
|
||||
|
||||
1.3.0-dev
|
||||
-security#GHSA-4rmr-wvjq-qxc2: Run the per-page realm check after Basic Auth and guest login instead of returning early (#8145)
|
||||
-security#GHSA-j67j-wpm4-9g3x: Require a CSRF-token POST for the user and group update_policy action (#8145)
|
||||
-security#GHSA-2p3x-f5jm-rg6p: Break the View-Graphs to poller remote code execution chain (#8145)
|
||||
-security#GHSA-x5pw-cg7j-mj4r: Run the bundled webhits poller script wc through a shell-free open (#8145)
|
||||
-security#GHSA-9737-rqh3-h7fh: Escape interpolated names in raise_message across the UI (#8145)
|
||||
-security#GHSA-9x9h-2577-9w86: Build the colordropdown autocomplete from nodes and text, not HTML strings (#8145)
|
||||
-security#GHSA-h96j-8xhc-2p3w: Authorize remote_agent on the genuine peer address, not forwarded headers (#8145)
|
||||
-security: Validate host_id before it is concatenated into the graph_view list and preview filter WHERE clauses (GHSA-r7hc-hrpv-52gf) (#8100) - Special Thanks to Jiecub3, Aur0ra-m and lz2y
|
||||
-security: Validate and bind local_graph_id in the aggregate graph item sequence query (GHSA-6mjm-5vwr-3fr2) (#8099) - Special Thanks to Jiecub3, Aur0ra-m and lz2y
|
||||
-security: Grant AllowOverride All in docker/apache.conf so shipped .htaccess denies on log/cache/scripts/cli take effect (GHSA-fxfg-j995-j69j)
|
||||
-security: Authorize the bulk Change Data Source Profile action against the owning device (GHSA-fc82-w6xq-4jg7)
|
||||
-security: Authorize Data Source enable/disable against the owning device before mutating (GHSA-2fhv-c794-v433)
|
||||
-security: Confine Reports format_file to a bare filename to close a path traversal/LFI regression (GHSA-5x27-wqpm-m24v)
|
||||
-security: Reject ORDER BY sort_column subquery payloads that bypassed the GHSA-q9xg-p762-9jm3 fix (GHSA-8j73-cvf6-jrvx)
|
||||
-security: Authorize Report save/edit against report ownership to close an authenticated IDOR (GHSA-8f5c-3h59-q7gc)
|
||||
-security: Stop building the Realtime RRD create command through a shell and validate DS bounds are numeric before they reach it (GHSA-f88m-q789-g22j)
|
||||
-security: Authorize tree node create/delete/move/rename/copy against per-tree access before mutating (GHSA-prxj-84qq-v5jq)
|
||||
-security: Authorize single-item Report actions (remove/move) against report ownership to close a guest-bind IDOR (GHSA-j5jh-fhwg-r56x)
|
||||
-security: Use validate_redirect_url() for the CSRF timeout redirect to close a tab-based open redirect bypass (GHSA-c725-4jm5-9fx5)
|
||||
-security: Require Package Management permission to trust new package signers (GHSA-gxgm-8rhv-r7jv)
|
||||
-security: Harden cmd.exe shell sinks and strip %VAR% from hostnames on win32 (GHSA-rjvj-r52f-8v5q) (#8056)
|
||||
-security#GHSA-77pr-g949-4v5f: Authorize the target graph before Spike Kill rewrites its RRD history (#8141)
|
||||
-security#GHSA-w3qw-762w-6g9v: Reject array-form GET actions that bypass the POST and CSRF guard (#8141)
|
||||
-security#GHSA-xhpr-w454-cc9w: Cast the stored data-query output_type before building the poller cache query (#8141)
|
||||
-security#GHSA-j3px-vw6r-g25x: Escape stored snmp_index values in the New Graphs data-query pivot (#8141)
|
||||
-security#GHSA-h745-3r76-g253: Escape the data-query and field names in the New Graphs parse error messages (#8141)
|
||||
-security#GHSA-69vw-qxxv-p8w2: Stop auto-granting an admin session when auth_method is None and fail closed pending a manual reset
|
||||
-security#GHSA-r7hc-hrpv-52gf: Validate host_id before it is concatenated into the graph_view list and preview filter WHERE clauses (#8100) - Special Thanks to Jiecub3, Aur0ra-m and lz2y
|
||||
-security#GHSA-6mjm-5vwr-3fr2: Validate and bind local_graph_id in the aggregate graph item sequence query (#8099) - Special Thanks to Jiecub3, Aur0ra-m and lz2y
|
||||
-security#GHSA-fxfg-j995-j69j: Grant AllowOverride All in docker/apache.conf so shipped .htaccess denies on log/cache/scripts/cli take effect
|
||||
-security#GHSA-fc82-w6xq-4jg7: Authorize the bulk Change Data Source Profile action against the owning device
|
||||
-security#GHSA-2fhv-c794-v433: Authorize Data Source enable/disable against the owning device before mutating
|
||||
-security#GHSA-5x27-wqpm-m24v: Confine Reports format_file to a bare filename to close a path traversal/LFI regression
|
||||
-security#GHSA-8j73-cvf6-jrvx: Reject ORDER BY sort_column subquery payloads that bypassed the GHSA-q9xg-p762-9jm3 fix
|
||||
-security#GHSA-8f5c-3h59-q7gc: Authorize Report save/edit against report ownership to close an authenticated IDOR
|
||||
-security#GHSA-f88m-q789-g22j: Stop building the Realtime RRD create command through a shell and validate DS bounds are numeric before they reach it
|
||||
-security#GHSA-prxj-84qq-v5jq: Authorize tree node create/delete/move/rename/copy against per-tree access before mutating
|
||||
-security#GHSA-j5jh-fhwg-r56x: Authorize single-item Report actions (remove/move) against report ownership to close a guest-bind IDOR
|
||||
-security#GHSA-c725-4jm5-9fx5: Use validate_redirect_url() for the CSRF timeout redirect to close a tab-based open redirect bypass
|
||||
-security#GHSA-gxgm-8rhv-r7jv: Require Package Management permission to trust new package signers
|
||||
@@ -50,7 +23,7 @@ Cacti CHANGELOG
|
||||
-security: Substitute query data before escaping graph titles and axis labels
|
||||
-security: Build forced-HTTPS redirects from the server-configured name
|
||||
-security: Replace sibling password-reset links and revoke authentication state after reset
|
||||
-security: Fail closed on a posted LDAP realm that is not a configured domain
|
||||
-security#GHSA-3jj2-v5ch-wmq5: Fail closed on a posted LDAP realm that is not a configured domain
|
||||
-security: Keep LDAP directory errors out of the login page
|
||||
-security: Demand TLS certificates for new LDAP domains
|
||||
-security: Restore the Cacti error handler on LDAP bind-only and empty-password paths
|
||||
@@ -209,7 +182,6 @@ Cacti CHANGELOG
|
||||
-issue#7695: Keep an empty argument on the command line
|
||||
-issue#7696: Repair the string sanitisers in lib/functions.php
|
||||
-issue#7697: Guard two divisions PHP 8 made fatal
|
||||
-issue#7693: Validate host_id before it reaches the graph template query
|
||||
-issue#7707: Bind the MIB column names in MibCache::select()
|
||||
-issue#7719: Spike Kill text output applied the large value scientific notation format to the column left of the value it belonged to, starting with Variance
|
||||
-issue#7732: Bind device IDs and escape graph and device HTML sinks
|
||||
@@ -418,6 +390,22 @@ Cacti CHANGELOG
|
||||
-feature#7634: Add indexes for host-template and session lookup queries
|
||||
-feature#7681: Add fail2ban support with a stable authentication-failure log line and a bundled filter
|
||||
|
||||
1.2.32
|
||||
-security#GHSA-4rmr-wvjq-qxc2: Run the per-page realm check after Basic Auth and guest login instead of returning early
|
||||
-security#GHSA-j67j-wpm4-9g3x: Require a CSRF-token POST for the user and group update_policy action
|
||||
-security#GHSA-2p3x-f5jm-rg6p: Break the View-Graphs to poller remote code execution chain
|
||||
-security#GHSA-x5pw-cg7j-mj4r: Run the bundled webhits poller script wc through a shell-free open
|
||||
-security#GHSA-9737-rqh3-h7fh: Escape interpolated names in raise_message across the UI
|
||||
-security#GHSA-9x9h-2577-9w86: Build the colordropdown autocomplete from nodes and text, not HTML strings
|
||||
-security#GHSA-h96j-8xhc-2p3w: Authorize remote_agent on the genuine peer address, not forwarded headers
|
||||
-security#GHSA-2fhv-c794-v433: Authorize Data Source enable/disable against the owning device before mutating
|
||||
-security#GHSA-prxj-84qq-v5jq: Authorize tree node create/delete/move/rename/copy against per-tree access before mutating
|
||||
-security#GHSA-77pr-g949-4v5f: Authorize the target graph before Spike Kill rewrites its RRD history
|
||||
-security#GHSA-w3qw-762w-6g9v: Reject array-form GET actions that bypass the POST and CSRF guard
|
||||
-security#GHSA-xhpr-w454-cc9w: Cast the stored data-query output_type before building the poller cache query
|
||||
-security#GHSA-j3px-vw6r-g25x: Escape stored snmp_index values in the New Graphs data-query pivot
|
||||
-security#GHSA-h745-3r76-g253: Escape the data-query and field names in the New Graphs parse error messages
|
||||
|
||||
1.2.x
|
||||
-issue#7212: Address a few small memory leaks in realtime graphing
|
||||
-issue#7359: Undefined variables detected with legacy plugins
|
||||
@@ -439,6 +427,7 @@ Cacti CHANGELOG
|
||||
-security#GHSA-xq98-376r-hv9j: CVE-2026-40079 Command Injection via escape_command() no-op in RRDtool execution
|
||||
-security#GHSA-69gg-mjfm-jjpc: CVE-2026-39893 Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php
|
||||
-security#GHSA-c4qp-j9r9-fq24: CVE-2026-39902 Authenticated RCE on Data Input
|
||||
-security#GHSA-r7hc-hrpv-52gf: Validate host_id before it reaches the graph template query
|
||||
-security#GHSA-rm7p-qcqm-x5m6: CVE-2026-39938 Unauthenticated LFI via graph_theme and rrdtool IPC serialization hardening
|
||||
-security#GHSA-vp35-4h28-r883: CVE-2026-39939 Path traversal in Package Import file write allows arbitrary file creation in webroot
|
||||
-security#GHSA-8522-5p3m-754c: CVE-2026-39949 Authenticated Remote Code Execution via Host Variable Injection
|
||||
|
||||
Reference in new issue
Block a user