Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 584
Alerts This Week
Warning Icon 1 584

Red Hat Gluster Storage 3.4 RHSA-2018:2615-01 Moderate: Collectd Update

red hat
Calendar Grey September 4, 2018
Scroller Redhat
Hash: SHA256 Red Hat Security Advisory Synopsis: Moderate: collectd security update Advisory ID: RHS
An update for collectd is now available for Red Hat Gluster Storage 3.4 for Red Hat Enterprise Linux 7

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

collectd is a host-based system statistics collection daemon that gathersmetrics from various sources periodically, such as the operating system, applications, log files and devices, and storage clusters. As the daemon does not start up each time it updates files, it has a low system footprint.
For Red Hat Gluster Storage Web Administration 3.4, collectd service is responsible for gathering metrics from Red Hat Gluster Storage clusters.
The updated collectd package includes the following security bug fixes.
Security Fix(es):
* collectd: Infinite loop due to incorrect interaction of parse_packet() and parse_part_sign_sha256() functions (CVE-2017-7401)
* collectd: double free in csnmp_read_table function in snmp.c (CVE-2017-16820)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
This updated package contains a number of bug fixes and enhancements, which are documented in detail in the Release Notes, linked in the References.
All users of collectd are advised to upgrade to these updated packages, which resolve these issues.

Topics%20covered

Topics Covered

security advisory moderate security fix red hat gluster collectd update system metrics

References

https://access.redhat.com/security/cve/CVE-2017-7401 https://access.redhat.com/security/cve/CVE-2017-16820 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/site/documentation/en-US/red_hat_gluster_storage/3.4/html/3.4_release_notes/

Package List

Red Hat Gluster 3.4 Web Administration Node Agent on RHEL-7:
Source: collectd-5.7.2-3.1.el7rhgs.src.rpm
x86_64: collectd-5.7.2-3.1.el7rhgs.x86_64.rpm collectd-debuginfo-5.7.2-3.1.el7rhgs.x86_64.rpm collectd-ping-5.7.2-3.1.el7rhgs.x86_64.rpm libcollectdclient-5.7.2-3.1.el7rhgs.x86_64.rpm
Red Hat Gluster 3.4 Web Administration on RHEL-7:
Source: collectd-5.7.2-3.1.el7rhgs.src.rpm
x86_64: collectd-5.7.2-3.1.el7rhgs.x86_64.rpm collectd-debuginfo-5.7.2-3.1.el7rhgs.x86_64.rpm collectd-ping-5.7.2-3.1.el7rhgs.x86_64.rpm libcollectdclient-5.7.2-3.1.el7rhgs.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Advisory ID: RHSA-2018:2615-01
Product: Red Hat Gluster Storage
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2615
Issue date: 2018-09-04

Topic

An update for collectd is now available for Red Hat Gluster Storage 3.4 forRed Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate security fix red hat gluster collectd update system metrics

Relevant Releases Architectures

Red Hat Gluster 3.4 Web Administration Node Agent on RHEL-7 - x86_64

Red Hat Gluster 3.4 Web Administration on RHEL-7 - x86_64

Bugs Fixed

1439674 - CVE-2017-7401 collectd: Infinite loop due to incorrect interaction of parse_packet() and parse_part_sign_sha256() functions

1516447 - CVE-2017-16820 collectd: double free in csnmp_read_table function in snmp.c

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.