Home / mailings [RHSA-2018:1605-01] Moderate: collectd security update
Posted on 17 May 2018
RedHat-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: collectd security update
Advisory ID: RHSA-2018:1605-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1605
Issue date: 2018-05-17
CVE Names: CVE-2017-16820
=====================================================================
1. Summary:
Updated collectd packages are now available for Red Hat OpenStack Platform
10.0 Operational Tools for RHEL 7.
Red Hat Product Security has rated this update as having a security impact
of
Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat OpenStack Platform 10.0 Operational Tools for RHEL 7 - x86_64
3. Description:
Red Hat OpenStack Platform Operational Tools provides the facilities for
monitoring a private or public Red Hat OpenStack Platform cloud.
collectd is a small C-language daemon, which reads various system metrics
periodically and updates RRD files (creating them if necessary). Because
the daemon does not start up each time it updates files, it has a low
system footprint.
Security fix:
* collectd: double free in csnmp_read_table function in snmp.c
(CVE-2017-16820)
For more details about the security issue, including impact, a CVSS score,
and other related information, refer to the CVE page listed in the
References section.
4. Solution:
Before applying this update, ensure all previously released errata relevant
to your system have been applied.
Red Hat OpenStack Platform 10 runs on Red Hat Enterprise Linux 7.5.
The Red Hat OpenStack Platform 10 Release Notes contain the following:
* An explanation of the way in which the provided components interact to
form a working cloud computing environment.
* Technology Previews, Recommended Practices, and Known Issues.
* The channels required for Red Hat OpenStack Platform 10, including which
channels need to be enabled and disabled.
The Release Notes are available at:
https://access.redhat.com/documentation/en/red-hat-openstack-platform/
This update is available through 'yum update' on systems registered through
Red Hat Subscription Manager. For more information about Red Hat
Subscription Manager, see:
https://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Manageme
nt/1/html/RHSM/index.html
5. Bugs fixed (https://bugzilla.redhat.com/):
1516447 - CVE-2017-16820 collectd: double free in csnmp_read_table function in snmp.c
1550149 - [UPDATES]Failed to on dependencies if collectd sub-packages are installed
6. Package List:
Red Hat OpenStack Platform 10.0 Operational Tools for RHEL 7:
Source:
collectd-5.8.0-10.el7ost.src.rpm
intel-cmt-cat-1.0.1-1.el7ost.src.rpm
x86_64:
collectd-5.8.0-10.el7ost.x86_64.rpm
collectd-apache-5.8.0-10.el7ost.x86_64.rpm
collectd-ascent-5.8.0-10.el7ost.x86_64.rpm
collectd-bind-5.8.0-10.el7ost.x86_64.rpm
collectd-ceph-5.8.0-10.el7ost.x86_64.rpm
collectd-curl-5.8.0-10.el7ost.x86_64.rpm
collectd-curl_json-5.8.0-10.el7ost.x86_64.rpm
collectd-curl_xml-5.8.0-10.el7ost.x86_64.rpm
collectd-dbi-5.8.0-10.el7ost.x86_64.rpm
collectd-debuginfo-5.8.0-10.el7ost.x86_64.rpm
collectd-disk-5.8.0-10.el7ost.x86_64.rpm
collectd-dns-5.8.0-10.el7ost.x86_64.rpm
collectd-drbd-5.8.0-10.el7ost.x86_64.rpm
collectd-email-5.8.0-10.el7ost.x86_64.rpm
collectd-generic-jmx-5.8.0-10.el7ost.x86_64.rpm
collectd-ipmi-5.8.0-10.el7ost.x86_64.rpm
collectd-iptables-5.8.0-10.el7ost.x86_64.rpm
collectd-ipvs-5.8.0-10.el7ost.x86_64.rpm
collectd-java-5.8.0-10.el7ost.x86_64.rpm
collectd-log_logstash-5.8.0-10.el7ost.x86_64.rpm
collectd-mcelog-5.8.0-10.el7ost.x86_64.rpm
collectd-memcachec-5.8.0-10.el7ost.x86_64.rpm
collectd-mysql-5.8.0-10.el7ost.x86_64.rpm
collectd-netlink-5.8.0-10.el7ost.x86_64.rpm
collectd-nginx-5.8.0-10.el7ost.x86_64.rpm
collectd-notify_email-5.8.0-10.el7ost.x86_64.rpm
collectd-openldap-5.8.0-10.el7ost.x86_64.rpm
collectd-ovs-events-5.8.0-10.el7ost.x86_64.rpm
collectd-ovs-stats-5.8.0-10.el7ost.x86_64.rpm
collectd-ping-5.8.0-10.el7ost.x86_64.rpm
collectd-postgresql-5.8.0-10.el7ost.x86_64.rpm
collectd-python-5.8.0-10.el7ost.x86_64.rpm
collectd-rdt-5.8.0-10.el7ost.x86_64.rpm
collectd-rrdcached-5.8.0-10.el7ost.x86_64.rpm
collectd-rrdtool-5.8.0-10.el7ost.x86_64.rpm
collectd-sensors-5.8.0-10.el7ost.x86_64.rpm
collectd-smart-5.8.0-10.el7ost.x86_64.rpm
collectd-snmp-5.8.0-10.el7ost.x86_64.rpm
collectd-snmp-agent-5.8.0-10.el7ost.x86_64.rpm
collectd-turbostat-5.8.0-10.el7ost.x86_64.rpm
collectd-utils-5.8.0-10.el7ost.x86_64.rpm
collectd-virt-5.8.0-10.el7ost.x86_64.rpm
collectd-write_http-5.8.0-10.el7ost.x86_64.rpm
collectd-write_sensu-5.8.0-10.el7ost.x86_64.rpm
collectd-write_tsdb-5.8.0-10.el7ost.x86_64.rpm
collectd-zookeeper-5.8.0-10.el7ost.x86_64.rpm
intel-cmt-cat-1.0.1-1.el7ost.x86_64.rpm
libcollectdclient-5.8.0-10.el7ost.x86_64.rpm
perl-Collectd-5.8.0-10.el7ost.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2017-16820
https://access.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
