CVE-2022-24807

Publication date 8 July 2022

Last updated 20 January 2025

Ubuntu priority

Cvss 3 Severity Score

net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a malformed OID in a SET request to `SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable` can cause an out-of-bounds memory access. A user with read-write credentials can exploit the issue. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
net-snmp	22.10 kinetic	Fixed 5.9.1+dfsg-4ubuntu2
	22.04 LTS jammy	Fixed 5.9.1+dfsg-1ubuntu2.2
	21.10 impish	Ignored end of life
	20.04 LTS focal	Fixed 5.8+dfsg-2ubuntu2.4
	18.04 LTS bionic	Fixed 5.7.3+dfsg-1.8ubuntu3.7
	16.04 LTS xenial	Fixed 5.7.3+dfsg-1ubuntu4.6+esm1 Ubuntu Pro
	14.04 LTS trusty	Fixed 5.7.2~dfsg-8.1ubuntu3.3+esm3 Ubuntu Pro

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro

Notes

mdeslaur

same commits as CVE-2022-24805

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
net-snmp	Upstream: 67ebb43 Upstream: 9a0cd7c

Severity score breakdown

Parameter	Value
Base score	6.5 · Medium
Attack vector	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	High
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N