Please publish commit for CVE fix

[bastien-roucaries]

Hi,

Can we get the commit for CVE-2024-43365, CVE-2024-43364, CVE-2024-43363, and CVE-2024-43362

Bastien on behalf of debian project

[TheWitness]

@netniV and @bastien-roucaries,

Are these new or published already in 1.2.28?

[TheWitness]

Just checked. @bastien-roucaries they have been made public. Can you not see the patches from the security section?

[bastien-roucaries]

@TheWitness no no patch from security section

[TheWitness]

There are pointers to the pull request though. Is that not enough?

[bastien-roucaries]

No they are no pointer to the public access GHS
And https://github.com/search?q=repo%3ACacti%2Fcacti%20GHSA-fgc6-g8gc-wcg5&type=code return only the changelog

[TheWitness]

That's disappointing. I'll look in my AM.

[bastien-roucaries]

@TheWitness any news ?

[TheWitness]

@netniV, @bastien-roucaries says he can not see the details in the Security Incidents to get the commit's for the security incidents. Can he not see our notes including the comments that pointed out the commit numbers? Is there any way to fix this?

[TheWitness]

@bastien-roucaries, look at this ticket too. I've already answered this one once.

#5798

But it would be nice for you to get all the details. If you are going to be the Debian guy moving forward, we can add you to the security team.

[carnil]

I can second this request, when having to fix cacti for instance in Debian, we cannot simply rebase to a newer version, so need to identify fixes for the security issues and backport the commits as needed.

Thanks a lot for your work on developing cacti!