Ubuntu Security Notice USN-6243-1 ≈ Packet Storm

Home ^[1] Files ^[2] News ^[3] &[SERVICES_TAB] Contact ^[4] Add New ^[5]

Ubuntu Security Notice USN-6243-1^[6]: Authored by Ubuntu ^[7] | Site security.ubuntu.com ^[8]; Ubuntu Security Notice 6243-1 - It was discovered that Graphite-Web incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform server-side request forgery and obtain sensitive information. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. It was discovered that Graphite-Web incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform cross site scripting and obtain sensitive information.; systems | linux ^[9], ubuntu ^[10]; advisories | CVE-2017-18638 ^[11], CVE-2022-4729 ^[12], CVE-2022-4730 ^[13]; SHA-256 | 1d0995a05bfb6ad2fa8ac23ac764746cf96df2b01811ed35e84375f6e0de6041; Download ^[14] | Favorite ^[15] | View ^[16]

        ==========================================================================
Ubuntu Security Notice USN-6243-1
July 25, 2023
graphite-web vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in Graphite-Web.
Software Description:
- graphite-web: A highly scalable real-time graphing system
Details:
It was discovered that Graphite-Web incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to perform
server-side request forgery and obtain sensitive information. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2017-18638)
It was discovered that Graphite-Web incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to perform
cross site scripting and obtain sensitive information. (CVE-2022-4728,
CVE-2022-4729, CVE-2022-4730)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
graphite-web                    1.1.8-1ubuntu0.22.04.1
Ubuntu 20.04 LTS:
graphite-web                    1.1.4-5ubuntu0.1
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
graphite-web                    1.0.2+debian-2ubuntu0.1~esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
graphite-web                    0.9.15+debian-1ubuntu0.1~esm1
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
graphite-web                    0.9.12+debian-3ubuntu0.1~esm2
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6243-1
CVE-2017-18638, CVE-2022-4728, CVE-2022-4729, CVE-2022-4730
Package Information:
https://launchpad.net/ubuntu/+source/graphite-web/1.1.8-1ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/graphite-web/1.1.4-5ubuntu0.1