{"schema_version":"1.7.2","id":"OESA-2022-1888","modified":"2022-09-02T11:04:14Z","published":"2022-09-02T11:04:14Z","upstream":["CVE-2022-24809","CVE-2022-24807","CVE-2022-24808","CVE-2022-24805","CVE-2022-24810","CVE-2022-24806"],"summary":"net-snmp security update","details":"Net-SNMP is a suite of applications used to implement SNMP v1, SNMP v2c and SNMP v3 using both IPv4 and IPv6. The suite includes:\n\n+\t\t- An extensible agent for responding to SNMP queries including built-in\n+\t\tsupport for a wide range of MIB information modules\n+\t\t- Command-line applications to retrieve and manipulate information from\n+\t\tSNMP-capable devices\n+\t\t- A daemon application for receiving SNMP notifications\n+\t\t- A library for developing new SNMP applications, with C and Perl APIs\n+\t\t- A graphical MIB browser.\r\n\r\nSecurity Fix(es):\r\n\r\nhttps://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES\nCVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference.(CVE-2022-24809)\r\n\r\nCVE-2022-24807 A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access.\nhttps://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES(CVE-2022-24807)\r\n\r\nhttps://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES\r\n\r\nCVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference(CVE-2022-24808)\r\n\r\n+*5.9.2*:\n+    security:\n+      - These two CVEs can be exploited by a user with read-only credentials:\n+          - CVE-2022-24805 A buffer overflow in the handling of the INDEX of\n+            NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.\n+          - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable\n+            can cause a NULL pointer dereference.\n+      - These CVEs can be exploited by a user with read-write credentials:\n+          - CVE-2022-24806 Improper Input Validation when SETing malformed\n+            OIDs in master agent and subagent simultaneously\n+          - CVE-2022-24807 A malformed OID in a SET request to\n+            SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an\n+            out-of-bounds memory access.\n+          - CVE-2022-24808 A malformed OID in a SET request to\n+            NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference\n+          - CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable\n+            can cause a NULL pointer dereference.\n+      - To avoid these flaws, use strong SNMPv3 credentials and do not share them.\n+        If you must use SNMPv1 or SNMPv2c, use a complex community string\n+        and enhance the protection by restricting access to a given IP address range.\n+      - Thanks are due to Yu Zhang of VARAS@IIE and Nanyu Zhong of VARAS@IIE for\n+        reporting the following CVEs that have been fixed in this release, and\n+        to Arista Networks for providing fixes.(CVE-2022-24805)\r\n\r\nhttps://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES\n CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference.(CVE-2022-24810)\r\n\r\nFrom https://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES\nCVE-2022-24806 Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously(CVE-2022-24806)","affected":[{"package":{"ecosystem":"openEuler:20.03-LTS-SP1","name":"net-snmp","purl":"pkg:rpm/openEuler/net-snmp\u0026distro=openEuler-20.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-6.oe1"}]}],"ecosystem_specific":{"aarch64":["net-snmp-5.9-6.oe1.aarch64.rpm","net-snmp-debuginfo-5.9-6.oe1.aarch64.rpm","net-snmp-perl-5.9-6.oe1.aarch64.rpm","python3-net-snmp-5.9-6.oe1.aarch64.rpm","net-snmp-libs-5.9-6.oe1.aarch64.rpm","net-snmp-gui-5.9-6.oe1.aarch64.rpm","net-snmp-devel-5.9-6.oe1.aarch64.rpm","net-snmp-debugsource-5.9-6.oe1.aarch64.rpm"],"noarch":["net-snmp-help-5.9-6.oe1.noarch.rpm"],"src":["net-snmp-5.9-6.oe1.src.rpm"],"x86_64":["python3-net-snmp-5.9-6.oe1.x86_64.rpm","net-snmp-debuginfo-5.9-6.oe1.x86_64.rpm","net-snmp-debugsource-5.9-6.oe1.x86_64.rpm","net-snmp-devel-5.9-6.oe1.x86_64.rpm","net-snmp-5.9-6.oe1.x86_64.rpm","net-snmp-gui-5.9-6.oe1.x86_64.rpm","net-snmp-perl-5.9-6.oe1.x86_64.rpm","net-snmp-libs-5.9-6.oe1.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:20.03-LTS-SP3","name":"net-snmp","purl":"pkg:rpm/openEuler/net-snmp\u0026distro=openEuler-20.03-LTS-SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-6.oe1"}]}],"ecosystem_specific":{"aarch64":["net-snmp-devel-5.9-6.oe1.aarch64.rpm","python3-net-snmp-5.9-6.oe1.aarch64.rpm","net-snmp-5.9-6.oe1.aarch64.rpm","net-snmp-libs-5.9-6.oe1.aarch64.rpm","net-snmp-gui-5.9-6.oe1.aarch64.rpm","net-snmp-debuginfo-5.9-6.oe1.aarch64.rpm","net-snmp-debugsource-5.9-6.oe1.aarch64.rpm","net-snmp-perl-5.9-6.oe1.aarch64.rpm"],"noarch":["net-snmp-help-5.9-6.oe1.noarch.rpm"],"src":["net-snmp-5.9-6.oe1.src.rpm"],"x86_64":["net-snmp-debugsource-5.9-6.oe1.x86_64.rpm","net-snmp-gui-5.9-6.oe1.x86_64.rpm","net-snmp-devel-5.9-6.oe1.x86_64.rpm","net-snmp-perl-5.9-6.oe1.x86_64.rpm","python3-net-snmp-5.9-6.oe1.x86_64.rpm","net-snmp-5.9-6.oe1.x86_64.rpm","net-snmp-debuginfo-5.9-6.oe1.x86_64.rpm","net-snmp-libs-5.9-6.oe1.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:22.03-LTS","name":"net-snmp","purl":"pkg:rpm/openEuler/net-snmp\u0026distro=openEuler-22.03-LTS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1-3.oe2203"}]}],"ecosystem_specific":{"aarch64":["net-snmp-perl-5.9.1-3.oe2203.aarch64.rpm","net-snmp-debuginfo-5.9.1-3.oe2203.aarch64.rpm","net-snmp-devel-5.9.1-3.oe2203.aarch64.rpm","net-snmp-gui-5.9.1-3.oe2203.aarch64.rpm","net-snmp-libs-5.9.1-3.oe2203.aarch64.rpm","net-snmp-debugsource-5.9.1-3.oe2203.aarch64.rpm","net-snmp-5.9.1-3.oe2203.aarch64.rpm","python3-net-snmp-5.9.1-3.oe2203.aarch64.rpm"],"noarch":["net-snmp-help-5.9.1-3.oe2203.noarch.rpm"],"src":["net-snmp-5.9.1-3.oe2203.src.rpm"],"x86_64":["net-snmp-5.9.1-3.oe2203.x86_64.rpm","net-snmp-gui-5.9.1-3.oe2203.x86_64.rpm","python3-net-snmp-5.9.1-3.oe2203.x86_64.rpm","net-snmp-perl-5.9.1-3.oe2203.x86_64.rpm","net-snmp-debuginfo-5.9.1-3.oe2203.x86_64.rpm","net-snmp-debugsource-5.9.1-3.oe2203.x86_64.rpm","net-snmp-devel-5.9.1-3.oe2203.x86_64.rpm","net-snmp-libs-5.9.1-3.oe2203.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1888"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24809"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24807"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24808"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24805"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24810"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24806"}],"database_specific":{"severity":"Medium"}}