A graphite-web security update has been released for Debian GNU/Linux 10 LTS to address a series of cross-site scripting (XSS) vulnerabilities.

DLA 3309-1: graphite-web security update

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3309-1 debian-lts@lists.debian.org
  https://www.debian.org/lts/security/ Chris Lamb
February 06, 2023   https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package : graphite-web
Version : 1.1.4-3+deb10u2
CVE IDs : CVE-2022-4728 CVE-2022-4729 CVE-2022-4730
Debian Bug : 1026992

It was discovered that there were a number of issues in graphite-web,
a tool provide realtime graphing of system statistics etc.

A series of cross-site scripting (XSS) vulnerabilties existed that
could have been exploited remotely. Issues existed in the Cookie
Handler, Template Name Handler and Absolute Time Range Handler
components.

For Debian 10 buster, these problems have been fixed in version
1.1.4-3+deb10u2.

We recommend that you upgrade your graphite-web packages.

For the detailed security status of graphite-web please refer to
its security tracker page at:
  https://security-tracker.debian.org/tracker/graphite-web

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at:   https://wiki.debian.org/LTS