{"id":"CVE-2019-20892","aliases":["ALPINE-CVE-2019-20892","DEBIAN-CVE-2019-20892","EUVD-2019-11428","GHSA-8q2p-wr8q-hv7c","RHBA-2020:1376","UBUNTU-CVE-2019-20892","USN-4410-1"],"status":"published","title":"net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c...","description":"net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02315,"percentile":0.83533,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2020-06-25T09:07:42Z","modified":"2026-10-20T13:55:54Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"net-snmp","fixed_in":["5.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"net-snmp","fixed_in":["5.8-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"net-snmp","fixed_in":["5.8+dfsg-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"net-snmp","fixed_in":["5.8+dfsg-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"net-snmp","fixed_in":["5.8+dfsg-3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"net-snmp","fixed_in":["1:5.8-12.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"net-snmp-agent-libs","fixed_in":["1:5.8-12.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"net-snmp-agent-libs-debuginfo","fixed_in":["1:5.8-12.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"net-snmp-debuginfo","fixed_in":["1:5.8-12.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"net-snmp-debugsource","fixed_in":["1:5.8-12.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"net-snmp-devel","fixed_in":["1:5.8-12.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"net-snmp-libs-debuginfo","fixed_in":["1:5.8-12.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"net-snmp-perl-debuginfo","fixed_in":["1:5.8-12.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"net-snmp-utils","fixed_in":["1:5.8-12.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"net-snmp-utils-debuginfo","fixed_in":["1:5.8-12.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"net-snmp","fixed_in":["1:5.8-12.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"net-snmp-agent-libs-debuginfo","fixed_in":["1:5.8-12.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"net-snmp-debuginfo","fixed_in":["1:5.8-12.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"net-snmp-debugsource","fixed_in":["1:5.8-12.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"net-snmp-libs","fixed_in":["1:5.8-12.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"net-snmp-libs-debuginfo","fixed_in":["1:5.8-12.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"net-snmp-perl-debuginfo","fixed_in":["1:5.8-12.el8_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"net-snmp-utils-debuginfo","fixed_in":["1:5.8-12.el8_1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"net-snmp","fixed_in":["5.8+dfsg-2ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8+dfsg-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8+dfsg-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8+dfsg-3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.8-12.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"net-snmp-agent-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.8-12.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"net-snmp-agent-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.8-12.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"net-snmp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.8-12.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"net-snmp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.8-12.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"net-snmp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.8-12.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"net-snmp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.8-12.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"net-snmp-perl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.8-12.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"net-snmp-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.8-12.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"net-snmp-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.8-12.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.8-12.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"net-snmp-agent-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.8-12.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"net-snmp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.8-12.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"net-snmp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.8-12.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"net-snmp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.8-12.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"net-snmp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.8-12.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"net-snmp-perl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.8-12.el8_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"net-snmp-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.8-12.el8_1.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8+dfsg-2ubuntu2.1"}]}],"versions":["5.7.3+dfsg-5ubuntu5","5.7.3+dfsg-5ubuntu6","5.8+dfsg-2ubuntu1","5.8+dfsg-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8+dfsg-2ubuntu2.1"}]}],"versions":["5.7.3+dfsg-5ubuntu5","5.7.3+dfsg-5ubuntu6","5.8+dfsg-2ubuntu1","5.8+dfsg-2ubuntu2"]}],"products":[{"vendor":"net-snmp","product":"net-snmp"},{"vendor":"oracle","product":"zfs_storage_appliance_kit"}],"references":[{"url":"https://bugs.launchpad.net/ubuntu/+source/net-snmp/+bug/1877027","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1663027","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://sourceforge.net/p/net-snmp/bugs/2923/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/net-snmp/net-snmp/commit/5f881d3bf24599b90d67a45cae7a3eb099cd71c9","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2020/06/25/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence","report"]},{"url":"https://usn.ubuntu.com/4410-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202008-12","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20892","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8q2p-wr8q-hv7c"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-20892","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-20892","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2020:1376","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1802055","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_1376.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-20892","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1851145","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20892","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2019-20892","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2020/06/25/4","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4410-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-20892","description":"net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release.","status":"published","published":"2020-06-25T09:07:42Z","modified":"2024-08-05T02:53:09.438Z","updated_at":"2026-11-02T14:20:17.431882Z"}],"euvd":[{"id":"EUVD-2019-11428","description":"net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release.","status":"published","published":"2020-06-25T09:07:42Z","modified":"2024-08-05T02:53:09Z","updated_at":"2026-11-03T02:40:20.270172Z"}],"ghsa":[{"id":"GHSA-8q2p-wr8q-hv7c","title":"net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c...","description":"net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release.","status":"published","published":"2022-05-24T17:21:39Z","modified":"2023-01-31T05:02:01Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:48:11.03026Z"}],"nvd":[{"id":"CVE-2019-20892","description":"net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release.","status":"published","published":"2020-06-25T10:15:10.667Z","modified":"2026-06-17T02:31:23.573Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:05:47.558959Z"}],"osv":[{"id":"ALPINE-CVE-2019-20892","description":"net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release.","status":"published","published":"2020-06-25T10:15:10.667Z","modified":"2026-09-21T06:17:52.511820989Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"CVE-2019-20892","description":"net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release.","status":"published","published":"2020-06-25T10:15:10.667Z","modified":"2026-10-20T13:55:54.750937705Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-20892","description":"net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release.","status":"published","published":"2020-06-25T10:15:10.667Z","modified":"2026-09-21T07:00:32.483982875Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"RHBA-2020:1376","title":"Red Hat Bug Fix Advisory: net-snmp bug fix and enhancement update","status":"published","published":"2024-09-16T03:45:49Z","modified":"2026-06-26T12:22:04.291332298Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"UBUNTU-CVE-2019-20892","description":"net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release.","status":"published","published":"2020-06-25T10:15:00Z","modified":"2026-04-22T12:17:59.019996Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"USN-4410-1","title":"net-snmp vulnerability","description":"A double-free bug was discovered in snmpd server. An authenticated user could\npotentially cause a DoS by sending a crafted request to the server.\n(CVE-2019-20892)\n","status":"published","published":"2020-07-02T19:23:37Z","modified":"2026-04-22T10:05:31.4592Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}