CVE-2022-24807

{"id": "CVE-2022-24807", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-04-16T20:15:08.647", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103225", "source": "security-advisories@github.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105239", "source": "security-advisories@github.com"}, {"url": "https://github.com/net-snmp/net-snmp/commit/67ebb43e9038b2dae6e74ae8838b36fcc10fc937", "source": "security-advisories@github.com"}, {"url": "https://github.com/net-snmp/net-snmp/commit/ce66eb97c17aa9a48bc079be7b65895266fa6775", "source": "security-advisories@github.com"}, {"url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00020.html", "source": "security-advisories@github.com"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FX75KKGMO5XMV6JMQZF6KOG3JPFNQBY7/", "source": "security-advisories@github.com"}, {"url": "https://security.gentoo.org/glsa/202210-29", "source": "security-advisories@github.com"}, {"url": "https://www.debian.org/security/2022/dsa-5209", "source": "security-advisories@github.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2103225", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105239", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/net-snmp/net-snmp/commit/67ebb43e9038b2dae6e74ae8838b36fcc10fc937", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/net-snmp/net-snmp/commit/ce66eb97c17aa9a48bc079be7b65895266fa6775", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00020.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FX75KKGMO5XMV6JMQZF6KOG3JPFNQBY7/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.gentoo.org/glsa/202210-29", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.debian.org/security/2022/dsa-5209", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-120"}]}], "descriptions": [{"lang": "en", "value": "net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a malformed OID in a SET request to `SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable` can cause an out-of-bounds memory access. A user with read-write credentials can exploit the issue. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.\n"}, {"lang": "es", "value": "net-snmp proporciona varias herramientas relacionadas con el protocolo simple de administraci\u00f3n de red. Antes de la versi\u00f3n 5.9.2, un OID con formato incorrecto en una solicitud SET a `SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable` puede provocar un acceso a la memoria fuera de los l\u00edmites. Un usuario con credenciales de lectura y escritura puede aprovechar el problema. La versi\u00f3n 5.9.2 contiene un parche. Los usuarios deben utilizar credenciales SNMPv3 seguras y evitar compartirlas. Aquellos que deben utilizar SNMPv1 o SNMPv2c deben utilizar una cadena de comunidad compleja y mejorar la protecci\u00f3n restringiendo el acceso a un rango de direcciones IP determinado."}], "lastModified": "2024-11-21T06:51:08.590", "sourceIdentifier": "security-advisories@github.com"}