From 13fc9dcb34926e9b6310b23662920c55c96d83a1 Mon Sep 17 00:00:00 2001 From: Daniel Lang Date: Sun, 1 Oct 2023 21:06:39 +0200 Subject: [PATCH] package/netsnmp: security bump to version 5.9.4 CVE-2022-44792 handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker (who has write access) to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service. CVE-2022-44793 handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service. The pgp key was changed [0] as the old one expired [1]. [0]: https://sourceforge.net/p/net-snmp/htdocs/ci/90a6d98aae21fcdff06b5be139eb4d44ae96a9de/ [1]: https://github.com/net-snmp/net-snmp/issues/595 Signed-off-by: Daniel Lang Signed-off-by: Peter Korsgaard (cherry picked from commit 868603755c16296ae2a61845891edeafc36e48ca) Signed-off-by: Peter Korsgaard --- package/netsnmp/netsnmp.hash | 6 +++--- package/netsnmp/netsnmp.mk | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/netsnmp/netsnmp.hash b/package/netsnmp/netsnmp.hash index e1e9d10898..7898941271 100644 --- a/package/netsnmp/netsnmp.hash +++ b/package/netsnmp/netsnmp.hash @@ -1,7 +1,7 @@ # Locally calculated after checking pgp signature at -# https://sourceforge.net/projects/net-snmp/files/net-snmp/5.9.3/net-snmp-5.9.3.tar.gz.asc -# using key D0F8F495DA6160C44EFFBF10F07B9D2DACB19FD6 -sha256 2097f29b7e1bf3f1300b4bae52fa2308d0bb8d5d3998dbe02f9462a413a2ef0a net-snmp-5.9.3.tar.gz +# https://sourceforge.net/projects/net-snmp/files/net-snmp/5.9.4/net-snmp-5.9.4.tar.gz.asc +# using key 6E6718AEF1EB5C65C32D1B2A356BC0B552D53CAB +sha256 8b4de01391e74e3c7014beb43961a2d6d6fa03acc34280b9585f4930745b0544 net-snmp-5.9.4.tar.gz # Hash for license file sha256 ed869ea395a1f125819a56676385ab0557a21507764bf56f2943302011381e59 COPYING diff --git a/package/netsnmp/netsnmp.mk b/package/netsnmp/netsnmp.mk index 15bc318e36..ae85f2697f 100644 --- a/package/netsnmp/netsnmp.mk +++ b/package/netsnmp/netsnmp.mk @@ -4,7 +4,7 @@ # ################################################################################ -NETSNMP_VERSION = 5.9.3 +NETSNMP_VERSION = 5.9.4 NETSNMP_SITE = https://downloads.sourceforge.net/project/net-snmp/net-snmp/$(NETSNMP_VERSION) NETSNMP_SOURCE = net-snmp-$(NETSNMP_VERSION).tar.gz NETSNMP_LICENSE = Various BSD-like