Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #1111333
| From | Moritz Mühlenhoff <jmm@inutil.org> |
|---|---|
| Newsgroups | linux.debian.bugs.dist |
| Subject | Bug#1016139: (net-snmp: CVE-2022-24810 CVE-2022-24809 CVE-2022-24808 CVE-2022-24807 CVE-2022-24806 CVE-2022-24805) |
| Date | 2022-07-29 16:40 +0200 |
| Message-ID | <EOzjH-eCX8-9@gated-at.bofh.it> (permalink) |
| References | (1 earlier) <ENWim-efef-9@gated-at.bofh.it> <EO9yV-enrC-11@gated-at.bofh.it> <EOa1X-enAS-11@gated-at.bofh.it> <ENWim-efef-9@gated-at.bofh.it> <EOa1X-enAS-11@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
Am Thu, Jul 28, 2022 at 09:25:44PM +1000 schrieb Craig Small:
> I said:
>
> > I had uploaded net-snmp 5.9.3 anyway but I'll add those CVEs to the
> > changelog.
> > I'm trying to find where they've made the changes to see if it is possible
> > to get at least bullseye fixed.
> >
> I've had a look and believe these two commits are the fixes:
>
> snmpd: fix bounds checking in NET-SNMP-AGENT-MIB, NET-SNMP-VACM-MIB,
> SNMP-VIEW-BASED-ACM-MIB, SNMP-USER-BASED-SM-MIB
> https://github.com/net-snmp/net-snmp/commit/67ebb43e9038b2dae6e74ae8838b36fcc10fc937
>
> snmpd: recover SET status from delegated request
> https://github.com/net-snmp/net-snmp/commit/9a0cd7c00947d5e1c6ceb54558d454f87c3b8341
>
> Both sets of commits look pretty clear and simple to implement. I've asked
> upstream to confirm these are the only two patches.
Ack, thanks!
Cheers,
Moritz
Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Find similar | Unroll thread
Bug#1016139: net-snmp: CVE-2022-24810 CVE-2022-24809 CVE-2022-24808 CVE-2022-24807 CVE-2022-24806 CVE-2022-24805 Moritz Mühlenhoff <jmm@inutil.org> - 2022-07-27 23:00 +0200 Bug#1016139: (net-snmp: CVE-2022-24810 CVE-2022-24809 CVE-2022-24808 CVE-2022-24807 CVE-2022-24806 CVE-2022-24805) Moritz Mühlenhoff <jmm@inutil.org> - 2022-07-29 16:40 +0200
csiph-web