openSUSE-SU-2021:0755-1

    Dashboard / Vulnerabilities / openSUSE-SU-2021:0755-1

    openSUSE-SU-2021:0755-1

    Published: 20 May 2021Last Modified: 4 Feb 2026
    Upstream:
    CVE-2020-35701

    Summary: Security update for cacti, cacti-spine

    Details: This update for cacti, cacti-spine fixes the following issues: cacti-spine was updated to 1.2.17: * Avoid triggering DDos detection in firewalls on large systems * Use mysql reconnect option properly * Fix possible creashes in various operations * Fix remote data collectors pushing too much data to main when performing diagnostics * Make spine more responsive when remote connection is down * Fix various MySQL issues * Make spine immune to DST changes cacti-spine 1.2.16: * Some developer debug log messages falsely labeled as WARNINGS * Remove the need of the dos2unix program * Fix Spine experiencing MySQL socket error 2002 under load * Under heavy load MySQL/MariaDB return 2006 and 2013 errors on query * Add backtrace output to stderr for signals * Add Data Source turnaround time to debug output cacti-spine 1.2.15: * Special characters may not always be ignored properly cacti was updated to 1.2.17: * Fix incorrect handling of fields led to potential XSS issues * CVE-2020-35701: Fix SQL Injection vulnerability (boo#1180804) * Fix various XSS issues with HTML Forms handling * Fix handling of Daylight Saving Time changes * Multiple fixes and extensions to plugins * Fix multiple display, export, and input validation issues * SNMPv3 Password field was not correctly limited * Improved regular expression handling for searcu * Improved support for RRDproxy * Improved behavior on large systems * MariaDB/MysQL: Support persistent connections and improve multiple operations and options * Add Theme 'Midwinter' * Modify automation to test for data before creating graphs * Add hooks for plugins to show customize graph source and customize template url * Allow CSRF security key to be refreshed at command line * Allow remote pollers statistics to be cleared * Allow user to be automatically logged out after admin defined period * When replicating, ensure Cacti can detect and verify replica servers

    References: https://lists.opensuse.org/archives/list/[email protected]/thread/DECT547ZRI4T4XP2OGBIPHTLXW2K7KTG/, https://bugzilla.suse.com/1180804, https://www.suse.com/security/cve/CVE-2020-35701

    Affected packages

    Package

    Name: cacti

    Purl: pkg:rpm/suse/cacti&distro=SUSE%20Package%20Hub%2012

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.2.17-20.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    openSUSE-SU-2021:0755-1 | CVE-DB