net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a malformed OID in a SET request to `SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable` can cause an out-of-bounds memory access. A user with read-write credentials can exploit the issue. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
History
17 Jan 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Redhat enterprise Linux Server Aus
Net-snmp Redhat enterprise Linux Update Services For Sap Solutions Redhat enterprise Linux For Power Little Endian Redhat enterprise Linux For Ibm Z Systems Redhat enterprise Linux For Power Little Endian Eus Redhat enterprise Linux Server Update Services For Sap Solutions Redhat Redhat enterprise Linux Eus Redhat enterprise Linux Debian debian Linux Net-snmp net-snmp Debian Redhat enterprise Linux For Ibm Z Systems Eus Fedoraproject Redhat enterprise Linux Server For Power Little Endian Update Services For Sap Solutions Fedoraproject fedora Redhat enterprise Linux For Arm 64 Eus Redhat enterprise Linux For Arm 64 |
|
| CPE | cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.4_aarch64:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.2_ppc64le:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.4_s390x:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.2_aarch64:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:* cpe:2.3:a:net-snmp:net-snmp:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.2_s390x:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:* |
|
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2103225 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2105239 - Third Party Advisory | |
| References | () https://github.com/net-snmp/net-snmp/commit/67ebb43e9038b2dae6e74ae8838b36fcc10fc937 - Patch | |
| References | () https://github.com/net-snmp/net-snmp/commit/ce66eb97c17aa9a48bc079be7b65895266fa6775 - Patch | |
| References | () https://lists.debian.org/debian-lts-announce/2022/08/msg00020.html - Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FX75KKGMO5XMV6JMQZF6KOG3JPFNQBY7/ - Product | |
| References | () https://security.gentoo.org/glsa/202210-29 - Third Party Advisory | |
| References | () https://www.debian.org/security/2022/dsa-5209 - Third Party Advisory |
21 Nov 2024, 06:51
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2103225 - | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2105239 - | |
| References | () https://github.com/net-snmp/net-snmp/commit/67ebb43e9038b2dae6e74ae8838b36fcc10fc937 - | |
| References | () https://github.com/net-snmp/net-snmp/commit/ce66eb97c17aa9a48bc079be7b65895266fa6775 - | |
| References | () https://lists.debian.org/debian-lts-announce/2022/08/msg00020.html - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FX75KKGMO5XMV6JMQZF6KOG3JPFNQBY7/ - | |
| References | () https://security.gentoo.org/glsa/202210-29 - | |
| References | () https://www.debian.org/security/2022/dsa-5209 - |
17 Apr 2024, 12:48
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-16 20:15
Updated : 2025-01-17 16:15
NVD link : CVE-2022-24807
Mitre link : CVE-2022-24807
CVE.ORG link : CVE-2022-24807
JSON object : View
Products Affected
redhat
- enterprise_linux
- enterprise_linux_for_ibm_z_systems
- enterprise_linux_for_power_little_endian
- enterprise_linux_update_services_for_sap_solutions
- enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
- enterprise_linux_for_arm_64_eus
- enterprise_linux_server_aus
- enterprise_linux_eus
- enterprise_linux_for_ibm_z_systems_eus
- enterprise_linux_for_arm_64
- enterprise_linux_server_update_services_for_sap_solutions
- enterprise_linux_for_power_little_endian_eus
debian
- debian_linux
fedoraproject
- fedora
net-snmp
- net-snmp
CWE
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')