Skip to content

Add additional security to the unserialize function #5245

Merged
netniV merged 20 commits intoCacti:1.2.xfrom
TheWitness:1.2.x
Feb 24, 2023
Merged

Add additional security to the unserialize function #5245
netniV merged 20 commits intoCacti:1.2.xfrom
TheWitness:1.2.x

Conversation

@TheWitness
Copy link
Copy Markdown
Member

  • This change will add additional security to prevent certain classes of exploits in Cacti's use of the unserialize() function.
  • Additionally, adding an additional setting to dsv_log() to reduce the amount of logging during use of the tool to test data sources vs. poller operations.

Searching for Poller Items Generates SQL Errors
* On large systems statistics gathering at the beginning of a poller run lead to excessive polling times
* It's important to remove all items from the poller_output table for the poller as it impacts the end of the previous poller
* The other change here has to do with large databases where the poller_output memory table can get pushed into swap.
* Moved statistics out of the internal loop, and made a few optimizations for the $totals query to perform better.
* We only care about total_ports if the snmp_port is > 0
This is a compromise with regard to a possible issue with MariaDB 10.3 to only allow this via setting, and only allow for single poller systems.

We will look to re-design this in a future Cacti release.
This test added multi-output values that return a NaN or 'U'.
Edit Graph Template link missing base_url.
Template Export missing Graph Template columns multiple and test_source
* This change will add additional security to prevent certain classes of exploits in Cacti's use of the unserialize function.
* Additionally, adding an additional setting to dsv_log() to reduce the amount of logging during use of the tool to test data sources vs. poller operations.
* SNMP-Options - Bulk Walk Maximum Repetitions ignored during save
* light PSR to remove tabs and replace with spaces.
"Balance Process Load" dont work after upgrade to 1.2.23
* Rebuilding Poller Cache from Utilities does not respect poller interval due to lack or ordering
* Decrementing of rrd_next_step is flawed
@TheWitness TheWitness requested a review from netniV February 23, 2023 00:46
* We still have references in the code to 'poller_lastrun' without the poller id.  Set the legacy value if the poller_id is 1
* If the poller_interval equals the cron interval, you can still have to bypass the scalability enhancement if you largest data source profile is larger than the poller interval
@netniV netniV merged commit 8c6cd77 into Cacti:1.2.x Feb 24, 2023
@netniV netniV changed the title QA: Add additional security to the unserialize function Add additional security to the unserialize function Feb 27, 2023
@github-actions github-actions bot locked and limited conversation to collaborators May 29, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants