net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a buffer overflow in the handling of the `INDEX` of `NET-SNMP-VACM-MIB` can cause an out-of-bounds memory access. A user with read-only credentials can exploit the issue. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
History
17 Jan 2025, 16:04
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2103225 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2105238 - Third Party Advisory | |
| References | () https://github.com/net-snmp/net-snmp/commit/67ebb43e9038b2dae6e74ae8838b36fcc10fc937 - Patch | |
| References | () https://github.com/net-snmp/net-snmp/commit/ce66eb97c17aa9a48bc079be7b65895266fa6775 - Patch | |
| References | () https://lists.debian.org/debian-lts-announce/2022/08/msg00020.html - Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FX75KKGMO5XMV6JMQZF6KOG3JPFNQBY7/ - Product | |
| References | () https://security.gentoo.org/glsa/202210-29 - Third Party Advisory | |
| References | () https://www.debian.org/security/2022/dsa-5209 - Third Party Advisory | |
| CPE | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0:*:*:*:*:*:*:* cpe:2.3:a:net-snmp:net-snmp:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.2_ppc64le:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.4_s390x:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.2_s390x:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.4_aarch64:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.2_aarch64:*:*:*:*:*:*:* |
|
| First Time |
Redhat enterprise Linux Server Update Services For Sap Solutions
Redhat enterprise Linux Redhat enterprise Linux Server Aus Redhat enterprise Linux Update Services For Sap Solutions Fedoraproject fedora Redhat enterprise Linux For Arm 64 Eus Debian debian Linux Net-snmp Redhat enterprise Linux For Arm 64 Redhat enterprise Linux Server For Power Little Endian Update Services For Sap Solutions Redhat enterprise Linux For Power Little Endian Eus Redhat enterprise Linux For Ibm Z Systems Redhat enterprise Linux Eus Redhat enterprise Linux For Power Little Endian Redhat Fedoraproject Redhat enterprise Linux For Ibm Z Systems Eus Net-snmp net-snmp Debian |
21 Nov 2024, 06:51
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2103225 - | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2105238 - | |
| References | () https://github.com/net-snmp/net-snmp/commit/67ebb43e9038b2dae6e74ae8838b36fcc10fc937 - | |
| References | () https://github.com/net-snmp/net-snmp/commit/ce66eb97c17aa9a48bc079be7b65895266fa6775 - | |
| References | () https://lists.debian.org/debian-lts-announce/2022/08/msg00020.html - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FX75KKGMO5XMV6JMQZF6KOG3JPFNQBY7/ - | |
| References | () https://security.gentoo.org/glsa/202210-29 - | |
| References | () https://www.debian.org/security/2022/dsa-5209 - |
17 Apr 2024, 12:48
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
16 Apr 2024, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-16 20:15
Updated : 2025-01-17 16:04
NVD link : CVE-2022-24805
Mitre link : CVE-2022-24805
CVE.ORG link : CVE-2022-24805
JSON object : View
Products Affected
debian
- debian_linux
redhat
- enterprise_linux_for_arm_64_eus
- enterprise_linux_for_ibm_z_systems
- enterprise_linux_for_power_little_endian
- enterprise_linux_for_power_little_endian_eus
- enterprise_linux_for_ibm_z_systems_eus
- enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
- enterprise_linux_for_arm_64
- enterprise_linux_server_update_services_for_sap_solutions
- enterprise_linux_update_services_for_sap_solutions
- enterprise_linux_server_aus
- enterprise_linux
- enterprise_linux_eus
fedoraproject
- fedora
net-snmp
- net-snmp
CWE
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')