Skip to content
OpenAdvisories
Medium ALAS2-2023-2366 6 CVEs

Moderate: net-snmp security update (Amazon Linux 2)

Published Nov 29, 2023 · Updated Dec 4, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-24810: A flaw was found in net-snmp. A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference issue. CVE-2022-24809: A flaw was found in net-snmp. A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference issue. CVE-2022-24808: A flaw was found in net-snmp. A malformed OID in a SET request to NET-SNMP-AG ENT-MIB::nsLogTable can cause a NULL pointer dereference issue. CVE-2022-24807: A flaw was found in net-snmp. A malformed OID in a SET request to the SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access issue. CVE-2022-24806: A flaw was found in net-snmp. This issue occurs due to improper input validation when simultaneously setting malformed OIDs in the master agent and subagent. CVE-2022-24805: A flaw was found in net-snmp. A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access issue.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2 net-snmp 1:5.7.2-49.amzn2.1.1
Amazon Linux · 2 net-snmp-agent-libs 1:5.7.2-49.amzn2.1.1
Amazon Linux · 2 net-snmp-debuginfo 1:5.7.2-49.amzn2.1.1
Amazon Linux · 2 net-snmp-devel 1:5.7.2-49.amzn2.1.1
Amazon Linux · 2 net-snmp-gui 1:5.7.2-49.amzn2.1.1
Amazon Linux · 2 net-snmp-libs 1:5.7.2-49.amzn2.1.1
Amazon Linux · 2 net-snmp-perl 1:5.7.2-49.amzn2.1.1
Amazon Linux · 2 net-snmp-python 1:5.7.2-49.amzn2.1.1
Amazon Linux · 2 net-snmp-sysvinit 1:5.7.2-49.amzn2.1.1
Amazon Linux · 2 net-snmp-utils 1:5.7.2-49.amzn2.1.1

Vulnerabilities 6

  • Medium 6.5
    CVE-2022-24805

    net-snmp: A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.

    net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a buffer overflow in the handling of the `INDEX` of `NET-SNMP-VACM-MIB` can cause an out-of-bounds memory access. A user with read-only credentials can…

    net-snmp Net-SNMP net-snmp net-snmp Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2022-24806

    net-snmp vulnerable to Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously

    net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can exploit an Improper Input Validation vulnerability when SETing malformed OIDs in master agent and subagent simul…

    net-snmp Net-SNMP net-snmp net-snmp Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2022-24807

    net-snmp: A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access

    net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a malformed OID in a SET request to `SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable` can cause an out-of-bounds memory access. A user with read-write credent…

    net-snmp Net-SNMP net-snmp net-snmp Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2022-24808

    net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference

    net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can use a malformed OID in a `SET` request to `NET-SNMP-AGENT-MIB::nsLogTable` to cause a NULL pointer dereference. …

    net-snmp Net-SNMP net-snmp net-snmp Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2022-24809

    net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference

    net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-only credentials can use a malformed OID in a `GET-NEXT` to the `nsVacmAccessTable` to cause a NULL pointer dereference. Version 5.9.2…

    net-snmp Net-SNMP net-snmp net-snmp Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2022-24810

    net-snmp: A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference.

    net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can use a malformed OID in a SET to the nsVacmAccessTable to cause a NULL pointer dereference. Version 5.9.2 contain…

    net-snmp Net-SNMP net-snmp net-snmp Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-24805.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-24806.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-24807.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-24808.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-24809.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-24810.html