-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: collectd security update Advisory ID: RHSA-2018:1605-01 Product: Red Hat Enterprise Linux OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2018:1605 Issue date: 2018-05-17 CVE Names: CVE-2017-16820 ===================================================================== 1. Summary: Updated collectd packages are now available for Red Hat OpenStack Platform 10.0 Operational Tools for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenStack Platform 10.0 Operational Tools for RHEL 7 - x86_64 3. Description: Red Hat OpenStack Platform Operational Tools provides the facilities for monitoring a private or public Red Hat OpenStack Platform cloud. collectd is a small C-language daemon, which reads various system metrics periodically and updates RRD files (creating them if necessary). Because the daemon does not start up each time it updates files, it has a low system footprint. Security fix: * collectd: double free in csnmp_read_table function in snmp.c (CVE-2017-16820) For more details about the security issue, including impact, a CVSS score, and other related information, refer to the CVE page listed in the References section. 4. Solution: Before applying this update, ensure all previously released errata relevant to your system have been applied. Red Hat OpenStack Platform 10 runs on Red Hat Enterprise Linux 7.5. The Red Hat OpenStack Platform 10 Release Notes contain the following: * An explanation of the way in which the provided components interact to form a working cloud computing environment. * Technology Previews, Recommended Practices, and Known Issues. * The channels required for Red Hat OpenStack Platform 10, including which channels need to be enabled and disabled. The Release Notes are available at: https://access.redhat.com/documentation/en/red-hat-openstack-platform/ This update is available through 'yum update' on systems registered through Red Hat Subscription Manager. For more information about Red Hat Subscription Manager, see: https://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Manageme nt/1/html/RHSM/index.html 5. Bugs fixed (https://bugzilla.redhat.com/): 1516447 - CVE-2017-16820 collectd: double free in csnmp_read_table function in snmp.c 1550149 - [UPDATES]Failed to on dependencies if collectd sub-packages are installed 6. Package List: Red Hat OpenStack Platform 10.0 Operational Tools for RHEL 7: Source: collectd-5.8.0-10.el7ost.src.rpm intel-cmt-cat-1.0.1-1.el7ost.src.rpm x86_64: collectd-5.8.0-10.el7ost.x86_64.rpm collectd-apache-5.8.0-10.el7ost.x86_64.rpm collectd-ascent-5.8.0-10.el7ost.x86_64.rpm collectd-bind-5.8.0-10.el7ost.x86_64.rpm collectd-ceph-5.8.0-10.el7ost.x86_64.rpm collectd-curl-5.8.0-10.el7ost.x86_64.rpm collectd-curl_json-5.8.0-10.el7ost.x86_64.rpm collectd-curl_xml-5.8.0-10.el7ost.x86_64.rpm collectd-dbi-5.8.0-10.el7ost.x86_64.rpm collectd-debuginfo-5.8.0-10.el7ost.x86_64.rpm collectd-disk-5.8.0-10.el7ost.x86_64.rpm collectd-dns-5.8.0-10.el7ost.x86_64.rpm collectd-drbd-5.8.0-10.el7ost.x86_64.rpm collectd-email-5.8.0-10.el7ost.x86_64.rpm collectd-generic-jmx-5.8.0-10.el7ost.x86_64.rpm collectd-ipmi-5.8.0-10.el7ost.x86_64.rpm collectd-iptables-5.8.0-10.el7ost.x86_64.rpm collectd-ipvs-5.8.0-10.el7ost.x86_64.rpm collectd-java-5.8.0-10.el7ost.x86_64.rpm collectd-log_logstash-5.8.0-10.el7ost.x86_64.rpm collectd-mcelog-5.8.0-10.el7ost.x86_64.rpm collectd-memcachec-5.8.0-10.el7ost.x86_64.rpm collectd-mysql-5.8.0-10.el7ost.x86_64.rpm collectd-netlink-5.8.0-10.el7ost.x86_64.rpm collectd-nginx-5.8.0-10.el7ost.x86_64.rpm collectd-notify_email-5.8.0-10.el7ost.x86_64.rpm collectd-openldap-5.8.0-10.el7ost.x86_64.rpm collectd-ovs-events-5.8.0-10.el7ost.x86_64.rpm collectd-ovs-stats-5.8.0-10.el7ost.x86_64.rpm collectd-ping-5.8.0-10.el7ost.x86_64.rpm collectd-postgresql-5.8.0-10.el7ost.x86_64.rpm collectd-python-5.8.0-10.el7ost.x86_64.rpm collectd-rdt-5.8.0-10.el7ost.x86_64.rpm collectd-rrdcached-5.8.0-10.el7ost.x86_64.rpm collectd-rrdtool-5.8.0-10.el7ost.x86_64.rpm collectd-sensors-5.8.0-10.el7ost.x86_64.rpm collectd-smart-5.8.0-10.el7ost.x86_64.rpm collectd-snmp-5.8.0-10.el7ost.x86_64.rpm collectd-snmp-agent-5.8.0-10.el7ost.x86_64.rpm collectd-turbostat-5.8.0-10.el7ost.x86_64.rpm collectd-utils-5.8.0-10.el7ost.x86_64.rpm collectd-virt-5.8.0-10.el7ost.x86_64.rpm collectd-write_http-5.8.0-10.el7ost.x86_64.rpm collectd-write_sensu-5.8.0-10.el7ost.x86_64.rpm collectd-write_tsdb-5.8.0-10.el7ost.x86_64.rpm collectd-zookeeper-5.8.0-10.el7ost.x86_64.rpm intel-cmt-cat-1.0.1-1.el7ost.x86_64.rpm libcollectdclient-5.8.0-10.el7ost.x86_64.rpm perl-Collectd-5.8.0-10.el7ost.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2017-16820 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBWv2fStzjgjWX9erEAQi2uA/+OEDMby47/e/vOXPZ/VVeiUzist1i2ATp NifJGxcQr4BU7NeO7A/AVi7uJEnOfZ5eDIfDUV30XutnWV1NUcaY4l4n0ezJTHtZ 05DYEIqfg/ZaSRvbEdMdJzgz7GhcpwMGKuTsKzu2lcRFBUheAwAr8nRGSRGGeFfc qRiVry+oZr/smAXmAt5IgG1VPpOD1RGrtzCH4KyOJNtEJqlmRsCouRRqLIEX8bLn lt907OueLYiYw3KC488MY20hnCsGZJTdUwCAPG/3VeqirbTS//S1yeSsKug4Gls1 YTSHW2LS3GHHrwrRUGRr2oZnQlbSDwz+kmH4HNxrzhpaIfKCFKoNA+UtyBkhov6S Pt1WBZcGMHQXDbEyl9lDfYj8QUcnqSd/Ezsfvazzy8+oqGtmq/cM1q5zIi2L2HJJ bv+BVja57Ydk2g3NqERxxpflS5FxoR88bXmFDLgrnGHisf5iehKZ6BHE9x0JGci4 Uc85AU6guYiaT5EcOCY/05z2zA5h4tRNrnFocFU6N6gYPjH18yTWa1IiU2PFidL9 7Jq0E9AL1gP7eLGoBac2n0eCzIe3bS+oo1wr4QE0FkqKBDDLpZaFY+3/iK6pY6Or HsidxC9BhIYbGRmyE/HBAey5VEH2zXWYzPool3P+9qUeZDtzzGd8QkA2c1YdUFL/ 5BD6zoMmAlc= =qPF8 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce