DSA-3794-3 munin -- muninID: oval:org.secpod.oval:def:602799 | Date: (C)2017-03-09 (M)2021-09-13 |
Class: PATCH | Family: unix |
The update for munin issued as DSA-3794-2 caused a regression leading to Perl warnings being appended to the munin-cgi-graph log file. Updated packages are now available to correct this issue. For reference, the original advisory text follows. Stevie Trujillo discovered a local file write vulnerability in munin, a network-wide graphing framework, when CGI graphs are enabled. GET parameters are not properly handled, allowing to inject options into munin-cgi-graph and overwriting any file accessible by the user running the cgi-process.