- ------------------------------------------------------------------------- Debian LTS Advisory DLA-3309-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb February 06, 2023 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : graphite-web Version : 1.1.4-3+deb10u2 CVE IDs : CVE-2022-4728 CVE-2022-4729 CVE-2022-4730 Debian Bug : 1026992 It was discovered that there were a number of issues in graphite-web, a tool provide realtime graphing of system statistics etc. A series of cross-site scripting (XSS) vulnerabilties existed that could have been exploited remotely. Issues existed in the Cookie Handler, Template Name Handler and Absolute Time Range Handler components. For Debian 10 buster, these problems have been fixed in version 1.1.4-3+deb10u2. We recommend that you upgrade your graphite-web packages. For the detailed security status of graphite-web please refer to its security tracker page at: https://security-tracker.debian.org/tracker/graphite-web Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS