SUSE-SU-2024:3976-1: pcp&distro=SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2024:3976-1 is a vulnerability in pcp&distro=SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 12-11-2024
   PublishedVulnerability first disclosed.
2. 04-02-2026
   Last modifiedVulnerability information updated.

Description

Security update for pcp This update for pcp fixes the following issues: pcp was updated from version 3.11.9 to version 6.2.0 (jsc#PED-8192, jsc#PED-8389): - Security issues fixed: * CVE-2024-45770: Fixed a symlink attack that allows escalating from the pcp to the root user (bsc#1230552) * CVE-2024-45769: Fixed a heap corruption through metric pmstore operations (bsc#1230551) * CVE-2023-6917: Fixed local privilege escalation from pcp user to root in /usr/libexec/pcp/lib/pmproxy (bsc#1217826) * CVE-2024-3019: Disabled redis proxy by default (bsc#1222121) - Major changes: * Add version 3 PCP archive support: instance domain change-deltas, Y2038-safe timestamps, nanosecond-precision timestamps, arbitrary timezones support, 64-bit file offsets used throughout for larger (beyond 2GB) individual volumes. + Opt-in using the /etc/pcp.conf PCP_ARCHIVE_VERSION setting + Version 2 archives remain the default (for next few years). * Switch to using OpenSSL only throughout PCP (dropped NSS/NSPR); this impacts on libpcp, PMAPI clients and PMCD use of encryption; these are now configured and used consistently with pmproxy HTTPS support and redis-server, which were both already using OpenSSL. * New nanosecond precision timestamp PMAPI calls for PCP library interfaces that make use of timestamps. These are all optional, and full backward compatibility is preserved for existing tools. * For the full list of changes please consult the packaged CHANGELOG file - Other packaging changes: * Reintroduce libuv support for SUSE Linux Enterprise 15 (bsc#1231345) * Moved pmlogger_daily into main package (bsc#1222815) * Switched logutil and pmieutil scripts from Type=oneshot to Type=exec (bsc#1186511) * Change dependency from openssl-devel >= 1.1.1 to openssl-devel >= 1.0.2p. Required for SUSE Linux Enterprise 12. * Disabled 'pmda-infiniband' subpackage for SUSE Linux Enterprise 12 to resolve build issues. * Introduce 'pmda-resctrl' package, disabled for architectures other than x86_64. * Change the architecture for various subpackages to 'noarch' as they contain no binaries. * Disable 'pmda-mssql', as it fails to build.

No weakness data has been published for this record.