[SECURITY] [DLA 3309-1] graphite-web security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3309-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Chris Lamb
February 06, 2023 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : graphite-web
Version : 1.1.4-3+deb10u2
CVE IDs : CVE-2022-4728 CVE-2022-4729 CVE-2022-4730
Debian Bug : 1026992
It was discovered that there were a number of issues in graphite-web,
a tool provide realtime graphing of system statistics etc.
A series of cross-site scripting (XSS) vulnerabilties existed that
could have been exploited remotely. Issues existed in the Cookie
Handler, Template Name Handler and Absolute Time Range Handler
components.
For Debian 10 buster, these problems have been fixed in version
1.1.4-3+deb10u2.
We recommend that you upgrade your graphite-web packages.
For the detailed security status of graphite-web please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/graphite-web
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmPhbBUACgkQHpU+J9Qx
Hlhd2Q//WCgFbzbyZ8l2PCPbLbUw2al3dvCBOpQGMnircZMhrUhsks0H7EruHdNK
GQs9oxLzYEXANmxT9yBPjIPz6ndEkfRVF+02U/XVY5JmkEZpOjgoQJkdAiq49vJH
nHh2bpoaVFk/F2e16QGKIJL2tWgrIOWjqmub5oncIiCsH/Hs5O6OVNaghBm4NPac
GEzOls/q6VPRN2NqGH9j47l/KQrkw9Z+3pM+C+F64cX5zTXjzrF9HJs5MHdbRlnR
TzA/x3aZnToL7pXArn5+NsOpV4aJcxpIM/Y/m3NA0FiXaQUXWY1w8lDKDdAvQcTL
+VioO53cJ6dRgfIZxDmpJ3piQo0wIB8qhmaY0RZiXqOntbnmhdKwXHV8W9Zncke8
nHqOI+8DUXL6KIJxLnIrXwiUY75UqbkOtBPCk1Ag4c6zCL+GpKJHnxnzyYD4RBYH
NNwof6m63IpfuxWWmZPChja9AbUIpc6qE3i4lU0JcDAWRHmpRjsXUiwp/bVdD4aX
25j8js0nsUD3iWFEoz1v47zf8IVEb4JGAeswiUEwIIm7DvSSpn2cum8NbjT6sdJo
O2pX0L5ghmnPQoaLiNTrQf9/IlveiF9AzhYjlqQomOGqesL9YWYCZ5RAG7n2phR+
pVp6jIAte7rJfLSELpE1J5UTEDPWX5w/aGWqbuMsu1blg9nOjIo=
=YIF4
-----END PGP SIGNATURE-----
Reply to: