Bug#1016139: (net-snmp: CVE-2022-24810 CVE-2022-24809 CVE-2022-24808 CVE-2022-24807 CVE-2022-24806 CVE-2022-24805)

From	Craig Small <csmall@debian.org>
Newsgroups	linux.debian.bugs.rc
Subject	Bug#1016139: (net-snmp: CVE-2022-24810 CVE-2022-24809 CVE-2022-24808 CVE-2022-24807 CVE-2022-24806 CVE-2022-24805)
Date	2022-07-28 13:40 +0200
Message-ID	<EOa1X-enAS-11@gated-at.bofh.it> (permalink)
References	<EO9yV-enrC-13@gated-at.bofh.it> <ENWim-efef-9@gated-at.bofh.it> <EO9yV-enrC-11@gated-at.bofh.it> <ENWim-efef-9@gated-at.bofh.it> <EO9yV-enrC-11@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

I said:

> I had uploaded net-snmp 5.9.3 anyway but I'll add those CVEs to the
> changelog.
> I'm trying to find where they've made the changes to see if it is possible
> to get at least bullseye fixed.
>
I've had a look and believe these two commits are the fixes:

snmpd: fix bounds checking in NET-SNMP-AGENT-MIB, NET-SNMP-VACM-MIB,
SNMP-VIEW-BASED-ACM-MIB, SNMP-USER-BASED-SM-MIB
https://github.com/net-snmp/net-snmp/commit/67ebb43e9038b2dae6e74ae8838b36fcc10fc937

snmpd: recover SET status from delegated request
https://github.com/net-snmp/net-snmp/commit/9a0cd7c00947d5e1c6ceb54558d454f87c3b8341

Both sets of commits look pretty clear and simple to implement. I've asked
upstream to confirm these are the only two patches.

 - Craig

Back to linux.debian.bugs.rc | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1016139: (net-snmp: CVE-2022-24810 CVE-2022-24809 CVE-2022-24808 CVE-2022-24807 CVE-2022-24806 CVE-2022-24805) Craig Small <csmall@debian.org> - 2022-07-28 13:40 +0200
  Bug#1016139: (net-snmp: CVE-2022-24810 CVE-2022-24809 CVE-2022-24808 CVE-2022-24807 CVE-2022-24806 CVE-2022-24805) Salvatore Bonaccorso <carnil@debian.org> - 2022-08-07 15:40 +0200
    Bug#1016139: For Review: Bug#1016139: (net-snmp: CVE-2022-24810 CVE-2022-24809 CVE-2022-24808 CVE-2022-24807 CVE-2022-24806 CVE-2022-24805) Moritz Muehlenhoff <jmm@inutil.org> - 2022-08-10 09:40 +0200

csiph-web