CVE-2017-6188

NameCVE-2017-6188
DescriptionMunin before 2.999.6 has a local file write vulnerability when CGI graphs are enabled. Setting multiple upper_limit GET parameters allows overwriting any file accessible to the www-data user.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-836-1, DSA-3794-1
Debian Bugs855705

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
munin (PTS)buster2.0.49-1fixed
bullseye2.0.67-3fixed
bookworm2.0.73-1fixed
sid, trixie2.0.75-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
muninsourcewheezy2.0.6-4+deb7u3DLA-836-1
muninsourcejessie2.0.25-1+deb8u1DSA-3794-1
muninsource(unstable)2.0.31-1855705

Notes

https://github.com/munin-monitoring/munin/issues/721

Search for package or bug name: Reporting problems