{"id":"CVE-2022-24809","aliases":["ALPINE-CVE-2022-24809","ALSA-2024:7260","BELL-CVE-2022-24809","DEBIAN-CVE-2022-24809","DLA-3088-1","DSA-5209-1","EUVD-2022-29609","MGASA-2022-0311","OESA-2022-1888","RHSA-2024:7260","RHSA-2024:7875","RLSA-2024:7260","SUSE-RU-2024:0029-1","SUSE-SU-2022:4205-1","SUSE-SU-2022:4205-2","UBUNTU-CVE-2022-24809","USN-5543-1","USN-5795-2","openSUSE-SU-2024:12174-1"],"status":"published","title":"net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference","description":"net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-only credentials can use a malformed OID in a `GET-NEXT` to the `nsVacmAccessTable` to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.01114,"percentile":0.66237,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2022-07-08T11:42:00Z","modified":"2026-11-03T08:00:19Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"net-snmp","fixed_in":["5.9.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"net-snmp","fixed_in":["5.9.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"net-snmp","fixed_in":["5.9.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"net-snmp","fixed_in":["5.9.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"net-snmp","fixed_in":["5.9.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"net-snmp","fixed_in":["5.9.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"net-snmp","fixed_in":["5.9.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"net-snmp","fixed_in":["5.9.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"net-snmp","fixed_in":["5.9.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"net-snmp","fixed_in":["5.9.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"net-snmp","fixed_in":["5.9.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"net-snmp","fixed_in":["5.9.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"net-snmp","fixed_in":["5.9.3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"net-snmp","fixed_in":["5.9.3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"net-snmp","fixed_in":["5.9.3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"net-snmp","fixed_in":["5.7.2~dfsg-8.1ubuntu3.3+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"net-snmp","fixed_in":["5.7.3+dfsg-1ubuntu4.6+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"net-snmp","fixed_in":["5.7.3+dfsg-1.8ubuntu3.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"net-snmp","fixed_in":["5.8+dfsg-2ubuntu2.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"net-snmp","fixed_in":["5.9.1+dfsg-1ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"net-snmp-agent-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"net-snmp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"net-snmp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"net-snmp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"net-snmp-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Debian:12","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.3+dfsg-5+deb10u3"}]}],"versions":["5.7.3+dfsg-5","5.7.3+dfsg-5+deb10u1","5.7.3+dfsg-5+deb10u2"],"bundled":6},{"source":"osv","ecosystem":"Debian:11","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9+dfsg-4+deb11u1"}]}],"versions":["5.9+dfsg-3"],"bundled":6},{"source":"osv","ecosystem":"Mageia:8","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-1.1.mga8"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-6.oe1"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-6.oe1"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1-3.oe2203"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"net-snmp-agent-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"net-snmp-agent-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"net-snmp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"net-snmp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"net-snmp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"net-snmp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"net-snmp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"net-snmp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"net-snmp-perl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"net-snmp-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"net-snmp-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-net-snmp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-11.el9_2.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"net-snmp-agent-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-11.el9_2.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"net-snmp-agent-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-11.el9_2.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"net-snmp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-11.el9_2.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"net-snmp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-11.el9_2.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"net-snmp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-11.el9_2.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"net-snmp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-11.el9_2.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"net-snmp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-11.el9_2.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"net-snmp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-11.el9_2.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"net-snmp-perl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-11.el9_2.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"net-snmp-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-11.el9_2.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"net-snmp-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-11.el9_2.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"python3-net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-11.el9_2.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"python3-net-snmp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-11.el9_2.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.9.1-13.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.4-14.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.4-14.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.4-14.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-150300.15.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-150300.15.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-150300.15.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-150300.15.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-150300.15.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-150300.15.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-150300.15.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-150300.15.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.3-150300.15.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.2~dfsg-8.1ubuntu3.3+esm3"}]}],"versions":["5.7.2~dfsg-8ubuntu1","5.7.2~dfsg-8ubuntu2","5.7.2~dfsg-8.1ubuntu1","5.7.2~dfsg-8.1ubuntu2","5.7.2~dfsg-8.1ubuntu3","5.7.2~dfsg-8.1ubuntu3.1","5.7.2~dfsg-8.1ubuntu3.2","5.7.2~dfsg-8.1ubuntu3.3","5.7.2~dfsg-8.1ubuntu3.3+esm1","5.7.2~dfsg-8.1ubuntu3.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.3+dfsg-1ubuntu4.6+esm1"}]}],"versions":["5.7.3+dfsg-1ubuntu2","5.7.3+dfsg-1ubuntu3","5.7.3+dfsg-1ubuntu4","5.7.3+dfsg-1ubuntu4.1","5.7.3+dfsg-1ubuntu4.2","5.7.3+dfsg-1ubuntu4.3","5.7.3+dfsg-1ubuntu4.4","5.7.3+dfsg-1ubuntu4.5","5.7.3+dfsg-1ubuntu4.6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.3+dfsg-1.8ubuntu3.7"}]}],"versions":["5.7.3+dfsg-1.7ubuntu1","5.7.3+dfsg-1.8ubuntu1","5.7.3+dfsg-1.8ubuntu2","5.7.3+dfsg-1.8ubuntu3","5.7.3+dfsg-1.8ubuntu3.1","5.7.3+dfsg-1.8ubuntu3.2","5.7.3+dfsg-1.8ubuntu3.3","5.7.3+dfsg-1.8ubuntu3.5","5.7.3+dfsg-1.8ubuntu3.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8+dfsg-2ubuntu2.4"}]}],"versions":["5.7.3+dfsg-5ubuntu5","5.7.3+dfsg-5ubuntu6","5.8+dfsg-2ubuntu1","5.8+dfsg-2ubuntu2","5.8+dfsg-2ubuntu2.1","5.8+dfsg-2ubuntu2.2","5.8+dfsg-2ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1+dfsg-1ubuntu2.2"}]}],"versions":["5.9+dfsg-3ubuntu2","5.9+dfsg-3ubuntu3","5.9+dfsg-3ubuntu4","5.9.1+dfsg-1ubuntu1","5.9.1+dfsg-1ubuntu2","5.9.1+dfsg-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.3+dfsg-1.8ubuntu3.7"}]}],"versions":["5.7.3+dfsg-1.7ubuntu1","5.7.3+dfsg-1.8ubuntu1","5.7.3+dfsg-1.8ubuntu2","5.7.3+dfsg-1.8ubuntu3","5.7.3+dfsg-1.8ubuntu3.1","5.7.3+dfsg-1.8ubuntu3.2","5.7.3+dfsg-1.8ubuntu3.3","5.7.3+dfsg-1.8ubuntu3.5","5.7.3+dfsg-1.8ubuntu3.6"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8+dfsg-2ubuntu2.4"}]}],"versions":["5.7.3+dfsg-5ubuntu5","5.7.3+dfsg-5ubuntu6","5.8+dfsg-2ubuntu1","5.8+dfsg-2ubuntu2","5.8+dfsg-2ubuntu2.1","5.8+dfsg-2ubuntu2.2","5.8+dfsg-2ubuntu2.3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1+dfsg-1ubuntu2.2"}]}],"versions":["5.9+dfsg-3ubuntu2","5.9+dfsg-3ubuntu3","5.9+dfsg-3ubuntu4","5.9.1+dfsg-1ubuntu1","5.9.1+dfsg-1ubuntu2","5.9.1+dfsg-1ubuntu2.1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.2~dfsg-8.1ubuntu3.3+esm3"}]}],"versions":["5.7.2~dfsg-8ubuntu1","5.7.2~dfsg-8ubuntu2","5.7.2~dfsg-8.1ubuntu1","5.7.2~dfsg-8.1ubuntu2","5.7.2~dfsg-8.1ubuntu3","5.7.2~dfsg-8.1ubuntu3.1","5.7.2~dfsg-8.1ubuntu3.2","5.7.2~dfsg-8.1ubuntu3.3","5.7.2~dfsg-8.1ubuntu3.3+esm1","5.7.2~dfsg-8.1ubuntu3.3+esm2"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.3+dfsg-1ubuntu4.6+esm1"}]}],"versions":["5.7.3+dfsg-1ubuntu2","5.7.3+dfsg-1ubuntu3","5.7.3+dfsg-1ubuntu4","5.7.3+dfsg-1ubuntu4.1","5.7.3+dfsg-1ubuntu4.2","5.7.3+dfsg-1ubuntu4.3","5.7.3+dfsg-1ubuntu4.4","5.7.3+dfsg-1ubuntu4.5","5.7.3+dfsg-1ubuntu4.6"],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.2-1.1"}]}],"bundled":6}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"net-snmp","product":"net-snmp"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_for_arm_64"},{"vendor":"redhat","product":"enterprise_linux_for_arm_64_eus"},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems"},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems_eus"},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian"},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian_eus"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions"},{"vendor":"redhat","product":"enterprise_linux_server_update_services_for_sap_solutions"},{"vendor":"redhat","product":"enterprise_linux_update_services_for_sap_solutions"}],"references":[{"url":"https://github.com/net-snmp/net-snmp/commit/ce66eb97c17aa9a48bc079be7b65895266fa6775","tags":["x_transferred","Patch","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103225","tags":["x_transferred","Third Party Advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/08/msg00020.html","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FX75KKGMO5XMV6JMQZF6KOG3JPFNQBY7/","tags":["x_transferred","Product","web"]},{"url":"https://security.gentoo.org/glsa/202210-29","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2022/dsa-5209","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105242","tags":["x_transferred","Third Party Advisory","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-24809","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:7260","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24805","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24806","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24807","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24808","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24809","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24810","tags":["report"]},{"url":"https://bugzilla.redhat.com/2103225","tags":["report"]},{"url":"https://bugzilla.redhat.com/2104759","tags":["report"]},{"url":"https://bugzilla.redhat.com/2104763","tags":["report"]},{"url":"https://bugzilla.redhat.com/2104766","tags":["report"]},{"url":"https://bugzilla.redhat.com/2104768","tags":["report"]},{"url":"https://bugzilla.redhat.com/2104769","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-7260.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-24809","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24809.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24809","tags":["advisory"]},{"url":"https://github.com/net-snmp/net-snmp","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-24809","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0311.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30697","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5543-1","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/FX75KKGMO5XMV6JMQZF6KOG3JPFNQBY7/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1888","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24807","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24808","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24805","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24810","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24806","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104759","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104763","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104766","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104768","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104769","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7260.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24805","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24806","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24807","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24808","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24809","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24810","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:7875","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7875.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:7260","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2024-29/suse-ru-20240029-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1181400","tags":["report"]},{"url":"https://bugzilla.suse.com/1206044","tags":["report"]},{"url":"https://bugzilla.suse.com/1214364","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24810","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224205-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201103","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224205-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-24809","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5795-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-24805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-24806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-24807","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-24808","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-24810","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-44792","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-44793","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-24809","title":"net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference","description":"net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-only credentials can use a malformed OID in a `GET-NEXT` to the `nsVacmAccessTable` to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.\n","status":"published","published":"2024-04-16T19:56:07.108Z","modified":"2024-08-03T04:20:50.442Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:34:34.576287Z"}],"euvd":[{"id":"EUVD-2022-29609","description":"net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-only credentials can use a malformed OID in a `GET-NEXT` to the `nsVacmAccessTable` to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.\n","status":"published","published":"2024-04-16T19:56:07Z","modified":"2024-08-03T04:20:50Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T03:25:48.512748Z"}],"nvd":[{"id":"CVE-2022-24809","description":"net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-only credentials can use a malformed OID in a `GET-NEXT` to the `nsVacmAccessTable` to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.\n","status":"published","published":"2024-04-16T20:15:09.033Z","modified":"2026-06-17T04:32:34.12Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:07:40.49892Z"}],"osv":[{"id":"ALPINE-CVE-2022-24809","description":"net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-only credentials can use a malformed OID in a `GET-NEXT` to the `nsVacmAccessTable` to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.\n","status":"published","published":"2024-04-16T20:15:09.033Z","modified":"2026-11-03T07:18:33.125605436Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"BELL-CVE-2022-24809","title":"CVE-2022-24809 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:40.544511Z","modified":"2026-01-26T09:47:05.295013Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-24809","title":"net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference","description":"net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-only credentials can use a malformed OID in a `GET-NEXT` to the `nsVacmAccessTable` to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.\n","status":"published","published":"2024-04-16T19:56:07.108Z","modified":"2026-10-28T02:30:42.462334355Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"DEBIAN-CVE-2022-24809","description":"net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-only credentials can use a malformed OID in a `GET-NEXT` to the `nsVacmAccessTable` to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.","status":"published","published":"2024-04-16T20:15:09.033Z","modified":"2026-11-03T08:00:19.061180147Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T08:25:15.646766Z"},{"id":"OESA-2022-1888","title":"net-snmp security update","description":"Net-SNMP is a suite of applications used to implement SNMP v1, SNMP v2c and SNMP v3 using both IPv4 and IPv6. The suite includes:\n\n+\t\t- An extensible agent for responding to SNMP queries including built-in\n+\t\tsupport for a wide range of MIB information modules\n+\t\t- Command-line applications to retrieve and manipulate information from\n+\t\tSNMP-capable devices\n+\t\t- A daemon application for receiving SNMP notifications\n+\t\t- A library for developing new SNMP applications, with C and Perl APIs\n+\t\t- A graphical MIB browser.\r\n\r\nSecurity Fix(es):\r\n\r\nhttps://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES\nCVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference.(CVE-2022-24809)\r\n\r\nCVE-2022-24807 A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access.\nhttps://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES(CVE-2022-24807)\r\n\r\nhttps://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES\r\n\r\nCVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference(CVE-2022-24808)\r\n\r\n+*5.9.2*:\n+    security:\n+      - These two CVEs can be exploited by a user with read-only credentials:\n+          - CVE-2022-24805 A buffer overflow in the handling of the INDEX of\n+            NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.\n+          - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable\n+            can cause a NULL pointer dereference.\n+      - These CVEs can be exploited by a user with read-write credentials:\n+          - CVE-2022-24806 Improper Input Validation when SETing malformed\n+            OIDs in master agent and subagent simultaneously\n+          - CVE-2022-24807 A malformed OID in a SET request to\n+            SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an\n+            out-of-bounds memory access.\n+          - CVE-2022-24808 A malformed OID in a SET request to\n+            NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference\n+          - CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable\n+            can cause a NULL pointer dereference.\n+      - To avoid these flaws, use strong SNMPv3 credentials and do not share them.\n+        If you must use SNMPv1 or SNMPv2c, use a complex community string\n+        and enhance the protection by restricting access to a given IP address range.\n+      - Thanks are due to Yu Zhang of VARAS@IIE and Nanyu Zhong of VARAS@IIE for\n+        reporting the following CVEs that have been fixed in this release, and\n+        to Arista Networks for providing fixes.(CVE-2022-24805)\r\n\r\nhttps://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES\n CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference.(CVE-2022-24810)\r\n\r\nFrom https://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES\nCVE-2022-24806 Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously(CVE-2022-24806)","status":"published","published":"2022-09-02T11:05:09Z","modified":"2026-08-18T01:17:17.143991404Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2024:7260","title":"Red Hat Security Advisory: net-snmp security update","status":"published","published":"2024-09-26T23:02:27Z","modified":"2026-03-18T11:35:36.826567Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:7875","title":"Red Hat Security Advisory: net-snmp security update","status":"published","published":"2024-10-10T00:19:19Z","modified":"2026-03-18T11:35:41.233058Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"UBUNTU-CVE-2022-24809","description":"net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-only credentials can use a malformed OID in a `GET-NEXT` to the `nsVacmAccessTable` to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.","status":"published","published":"2022-07-08T11:42:00Z","modified":"2026-04-22T13:19:50.380257Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"ALSA-2024:7260","title":"Moderate: net-snmp security update","description":"The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol (SNMP), including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl Management Information Base (MIB) browser.\n\nSecurity Fix(es):\n\n* net-snmp: A buffer overflow in the handling of the INDEX of             NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. (CVE-2022-24805)\n* : net-snmp: Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously (CVE-2022-24806)\n* net-snmp: A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access (CVE-2022-24807)\n* net-snmp: A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. (CVE-2022-24809)\n* net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference (CVE-2022-24808)\n* net-snmp: A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. (CVE-2022-24810)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-26T00:00:00Z","modified":"2026-10-29T11:32:10.911601626Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"DLA-3088-1","title":"net-snmp - security update","status":"published","published":"2022-08-30T00:00:00Z","modified":"2026-03-09T01:20:16.000686Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5209-1","title":"net-snmp - security update","status":"published","published":"2022-08-16T00:00:00Z","modified":"2026-03-09T02:11:12.309764Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0311","title":"Updated net-snmp packages fix security vulnerability","description":"A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can\ncause an out-of-bounds memory access. (CVE-2022-24805)\nBuffer overflow and out of bounds memory access. (CVE-2022-24806)\nA malformed OID in a SET request to\nSNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory\naccess. (CVE-2022-24807)\nA malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can\ncause a NULL pointer dereference. (CVE-2022-24808)\nA malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL\npointer dereference. (CVE-2022-24809)\nA malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer\ndereference. (CVE-2022-24810)\n","status":"published","published":"2022-08-29T05:07:41Z","modified":"2026-04-16T04:44:44.457465857Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12174-1","title":"libsnmp40-32bit-5.9.2-1.1 on GA media","description":"These are all security issues fixed in the libsnmp40-32bit-5.9.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:34:36.464648Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"RLSA-2024:7260","title":"Moderate: net-snmp security update","description":"The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol (SNMP), including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl Management Information Base (MIB) browser.\n\nSecurity Fix(es):\n\n* net-snmp: A buffer overflow in the handling of the INDEX of             NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. (CVE-2022-24805)\n\n* : net-snmp: Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously (CVE-2022-24806)\n\n* net-snmp: A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access (CVE-2022-24807)\n\n* net-snmp: A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. (CVE-2022-24809)\n\n* net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference (CVE-2022-24808)\n\n* net-snmp: A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. (CVE-2022-24810)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-30T14:31:43.994145Z","modified":"2026-02-05T10:30:09.63503Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"SUSE-RU-2024:0029-1","title":"Recommended update for net-snmp","description":"This update for net-snmp fixes the following issues:\n\nUpdate to net-snmp-5.9.4 (bsc#1214364 jsc#PED-6435).\n\n* 5.9.4:\n\n  - libsnmp:\n\n      - Remove the SNMP_SWIPE_MEM() macro Remove this macro since it is not\n\tused in the Net-SNMP code base.\n      - DISPLAY-HINT fixes\n      - Miscellanious improvements to the transports\n      - Handle multiple oldEngineID configuration lines \n      - fixes for DNS names longer than 63 characters\n\n  - agent:\n\n      - Added a ignoremount configuration option for the HOST-MIB\n      - disallow SETs with a NULL varbind\n      - fix the --enable-minimalist build\n\n  - apps:\n\n      - snmpset: allow SET with NULL varbind for testing\n      - snmptrapd: improved MySQL logging code\n\n  - general:\n\n      - configure: Remove -Wno-deprecated as it is no longer needed\n      - miscellanious ther bug fixes, build fixes and cleanups\n\n  - security:\n\n      - These two CVEs can be exploited by a user with read-only credentials:\n\n          - CVE-2022-24805�A buffer overflow in the handling of the INDEX of\n            NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.\n          - CVE-2022-24809�A malformed OID in a GET-NEXT to the nsVacmAccessTable\n            can cause a NULL pointer dereference.\n\n      - These CVEs can be exploited by a user with read-write credentials:\n\n          - CVE-2022-24806�Improper Input Validation when SETing malformed\n            OIDs in master agent and subagent simultaneously\n          - CVE-2022-24807�A malformed OID in a SET request to\n            SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an\n            out-of-bounds memory access.\n          - CVE-2022-24808�A malformed OID in a SET request to\n            NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference\n          - CVE-2022-24810�A malformed OID in a SET to the nsVacmAccessTable\n            can cause a NULL pointer dereference.\n      - To avoid these flaws, use strong SNMPv3 credentials and do not share them.\n        If you must use SNMPv1 or SNMPv2c, use a complex community string\n        and enhance the protection by restricting access to a given IP address range.\n      - Thanks are due to�Yu Zhang of VARAS@IIE and Nanyu Zhong of VARAS@IIE for\n        reporting the following CVEs that have been fixed in this release, and\n        to Arista Networks for providing fixes.\n\n    - IF-MIB: Update ifTable entries even if the interface name has changed\n      At least on Linux a network interface index may be reused for a\n      network interface with a different name. Hence this patch that\n      enables replacing network interface information even if the network\n      interface name has changed.\n\n    - unspecified:\n\n      - Moved transport code into a separate subdirectory in snmplib\n      - Snmplib: remove inline versions of container funcs'.\n\n    - misc:\n\n      - snmp-create-v3-user: Fix the snmpd.conf path   @datadir@ is\n        expanded in ${datarootdir} so datarootdir must be set before\n        @datadir@ is used.\n\n* 5.9:\n\n  - snmplib:\n\n      - Add IPv6 support to DTLSUDP transport\n      - use new netsnmp_sockaddr_storage in netsnmp_addr_pair\n      - add base_transport ptr for tunneled transports\n      - Dtls: overhaul of debug\n      - Remove inline versions of container funcs\n\n  - snmpd:\n\n      - Use ETHTOOL_GLINKSETTINGS when available Newer Linux kernels\n\tsupport ETHTOOL_GLINKSETTINGS. Use it when available instead of the\n\tolder and deprecated ETHTOOL_GSET. This patch avoids that the Linux\n\tkernel reports the following kernel warning: warning: 'snmpd' uses\n\tlegacy ethtool link settings API, link modes are only partially\n\treported See also https://sourceforge.net/p/net-snmp/patches/1387/.\n      - [BUG 2926]: Make it possible to set agentXPingInterval for a\n\tsubagent - register agentXPingInterval for the subagent list\n\thandler, before it was registered for snmp - added agentxTimeout to\n\tthe subagent list handler. It's now possible to set for snmpd and\n\tthe subagent. See 'man snmpd.conf' - added agentxRetries to the\n\tsubagent list handler. See 'man snmpd.conf'. It's never used in the\n\tsubagent, but it's now following the documentation Signed-off-by:\n\tAnders Wallin \u003cwallinux@gmail.com\u003e\n\n    - snmptrap:\n\n      - BUG: 2899: Patch from Drew Roedersheimer to set library\n\tengineboots/time values before sending\n\n    - snmptrapd:\n\n      - Add support for the latest libmysqlclient version\n\n    - libsnmp:\n\n      - Scan MIB directories in alphabetical order This guarantees that\n\te.g. mibs/RFC1213-MIB.txt is read before mibs/SNMPv2-MIB.txt. The\n\torder in which these MIBs is read matters because both define\n\tsysLocation but with different attributes.\n\n\n- Removing legacy MIBs used by Velocity Software (jsc#PED-6416 jsc#PED-6434).\n- Added hardening to systemd service(s) (bsc#1181400, bsc#1206044).\n","status":"published","published":"2024-01-04T10:21:18Z","modified":"2026-02-04T04:22:07.559167Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2022:4205-1","title":"Security update for net-snmp","description":"This update for net-snmp fixes the following issues:\n\n  Updated to version 5.9.3 (bsc#1201103, jsc#SLE-11203):\n\n  - CVE-2022-24805: Fixed a buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB that can cause an out-of-bounds memory access.\n  - CVE-2022-24809: Fixed a malformed OID in a GET-NEXT to the nsVacmAccessTable that can cause a NULL pointer dereference.\n  - CVE-2022-24806: Fixed an improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously.\n  - CVE-2022-24807: Fixed a malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access.\n  - CVE-2022-24808: Fixed a malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference.\n  - CVE-2022-24810: Fixed a malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference.\n","status":"published","published":"2022-11-23T16:35:05Z","modified":"2025-05-02T04:32:52.56834Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4205-2","title":"Security update for net-snmp","description":"This update for net-snmp fixes the following issues:\n\n  Updated to version 5.9.3 (bsc#1201103, jsc#SLE-11203):\n\n  - CVE-2022-24805: Fixed a buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB that can cause an out-of-bounds memory access.\n  - CVE-2022-24809: Fixed a malformed OID in a GET-NEXT to the nsVacmAccessTable that can cause a NULL pointer dereference.\n  - CVE-2022-24806: Fixed an improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously.\n  - CVE-2022-24807: Fixed a malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access.\n  - CVE-2022-24808: Fixed a malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference.\n  - CVE-2022-24810: Fixed a malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference.\n","status":"published","published":"2022-12-13T11:49:18Z","modified":"2025-05-02T04:32:52.63028Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"USN-5543-1","title":"net-snmp vulnerabilities","description":"Yu Zhang and Nanyu Zhong discovered that Net-SNMP incorrectly handled\nmemory operations when processing certain requests. A remote attacker could\nuse this issue to cause Net-SNMP to crash, resulting in a denial of\nservice, or possibly execute arbitrary code.\n","status":"published","published":"2022-08-01T14:24:47Z","modified":"2026-04-22T10:26:41.159911Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-5795-2","title":"net-snmp vulnerabilities","description":"USN-5795-1 and 5543-1 fixed several vulnerabilities in Net-SNMP. This update provides\nthe corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that Net-SNMP incorrectly handled certain requests. A\n remote attacker could possibly use these issues to cause Net-SNMP to crash,\n resulting in a denial of service.\n\n Yu Zhang and Nanyu Zhong discovered that Net-SNMP incorrectly handled\n memory operations when processing certain requests. A remote attacker could\n use this issue to cause Net-SNMP to crash, resulting in a denial of\n service, or possibly execute arbitrary code.\n","status":"published","published":"2023-01-16T12:18:48Z","modified":"2026-06-29T13:50:45.103996462Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}