Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-43958: A flaw was found in rrdcached, a component of rrdtool. A local attacker with access to a rrdcached socket can exploit a stack-based buffer overflow by sending an oversized CREATE request. This vulnerability can lead to a denial of service by crashing the daemon or potentially allow for arbitrary code execution, impacting the integrity and confidentiality of data.
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | python3-rrdtool | 0:1.7.2-16.amzn2023.0.4 |
| Amazon Linux · 2023 | python3-rrdtool-debuginfo | 0:1.7.2-16.amzn2023.0.4 |
| Amazon Linux · 2023 | rrdtool | 0:1.7.2-16.amzn2023.0.4 |
| Amazon Linux · 2023 | rrdtool-debuginfo | 0:1.7.2-16.amzn2023.0.4 |
| Amazon Linux · 2023 | rrdtool-debugsource | 0:1.7.2-16.amzn2023.0.4 |
| Amazon Linux · 2023 | rrdtool-devel | 0:1.7.2-16.amzn2023.0.4 |
| Amazon Linux · 2023 | rrdtool-doc | 0:1.7.2-16.amzn2023.0.4 |
| Amazon Linux · 2023 | rrdtool-lua | 0:1.7.2-16.amzn2023.0.4 |
| Amazon Linux · 2023 | rrdtool-lua-debuginfo | 0:1.7.2-16.amzn2023.0.4 |
| Amazon Linux · 2023 | rrdtool-perl | 0:1.7.2-16.amzn2023.0.4 |
| Amazon Linux · 2023 | rrdtool-perl-debuginfo | 0:1.7.2-16.amzn2023.0.4 |
| Amazon Linux · 2023 | rrdtool-tcl | 0:1.7.2-16.amzn2023.0.4 |
| Amazon Linux · 2023 | rrdtool-tcl-debuginfo | 0:1.7.2-16.amzn2023.0.4 |
Vulnerabilities 1
-
High 7.8
Rrdtool: rrdtool: stack buffer overflow allows local code execution or denial of service
A flaw was found in rrdcached, a component of rrdtool. A local attacker with access to a rrdcached socket can exploit a stack-based buffer overflow by sending an oversized CREATE request. This vulnerability can lead to a denial of service by crashing the daem…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-43958.html