-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: collectd security update
Advisory ID:       RHSA-2018:2615-01
Product:           Red Hat Gluster Storage
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:2615
Issue date:        2018-09-04
CVE Names:         CVE-2017-7401 CVE-2017-16820 
=====================================================================

1. Summary:

An update for collectd is now available for Red Hat Gluster Storage 3.4 for
Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Gluster 3.4 Web Administration Node Agent on RHEL-7 - x86_64
Red Hat Gluster 3.4 Web Administration on RHEL-7 - x86_64

3. Description:

collectd is a host-based system statistics collection daemon that gathers
metrics from various sources periodically, such as the operating system,
applications, log files and devices, and storage clusters. As the daemon
does not start up each time it updates files, it has a low system
footprint.

For Red Hat Gluster Storage Web Administration 3.4, collectd service is
responsible for gathering metrics from Red Hat Gluster Storage clusters. 

The updated collectd package includes the following security bug fixes.

Security Fix(es):

* collectd: Infinite loop due to incorrect interaction of parse_packet()
and parse_part_sign_sha256() functions (CVE-2017-7401)

* collectd: double free in csnmp_read_table function in snmp.c
(CVE-2017-16820)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

This updated package contains a number of bug fixes and enhancements, which
are documented in detail in the Release Notes, linked in the References.

All users of collectd are advised to upgrade to these updated packages,
which resolve these issues.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1439674 - CVE-2017-7401 collectd: Infinite loop due to incorrect interaction of parse_packet() and parse_part_sign_sha256() functions
1516447 - CVE-2017-16820 collectd: double free in csnmp_read_table function in snmp.c

6. Package List:

Red Hat Gluster 3.4 Web Administration Node Agent on RHEL-7:

Source:
collectd-5.7.2-3.1.el7rhgs.src.rpm

x86_64:
collectd-5.7.2-3.1.el7rhgs.x86_64.rpm
collectd-debuginfo-5.7.2-3.1.el7rhgs.x86_64.rpm
collectd-ping-5.7.2-3.1.el7rhgs.x86_64.rpm
libcollectdclient-5.7.2-3.1.el7rhgs.x86_64.rpm

Red Hat Gluster 3.4 Web Administration on RHEL-7:

Source:
collectd-5.7.2-3.1.el7rhgs.src.rpm

x86_64:
collectd-5.7.2-3.1.el7rhgs.x86_64.rpm
collectd-debuginfo-5.7.2-3.1.el7rhgs.x86_64.rpm
collectd-ping-5.7.2-3.1.el7rhgs.x86_64.rpm
libcollectdclient-5.7.2-3.1.el7rhgs.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2017-7401
https://access.redhat.com/security/cve/CVE-2017-16820
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/site/documentation/en-US/red_hat_gluster_storage/3.4/html/3.4_release_notes/

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBW44oitzjgjWX9erEAQgEyw/9FnseauLMHRqYlqOpyU9i1YTxaNnTcvNe
L6KCgjMG6jsv19fmnNvtBny1LNlbfU4B+mmJYM+xJrguOUg1Mw8Vla15opQG+8iQ
vgVRHNFZ1DUpy6J0D6hdsfisGSqDP7P75cZ/b5oiYDSSOBiDZiuDhz8KQPKIxFC0
m8GzakJPg3zs1Ih1VTp4tqgn3jt6cdq3Q1KuwXGYRuBvOYiLTzmRzztcf516hXAP
go6cCufE7cml7tQLdFyHvWntWuCcbqyomKLKx6llGNSRIUrc13XrtRjfG0sphT1a
ev/xcNxrt/bo55QgQ4DTf90tPu/ko8thWtYmyHmd4EHuk8t9lV5xUZDSwsK2Iqjg
IEAsONlEA73jHpfebrZdGJ8jEBHostLHCOfe8889txXI0/HJdRi6PEoCEjVx/+Cb
fRDnVPycHhFlAJsLbKerf8RuwCKn+dzhx3NNunR0xvBl8I02kE5BgQOQlnrnf0hT
V5T8PiR1mLtfEDxmVpb9ht+bDDdvLV7RwPdrCPLcxcGnUlRXOu+50epVV4wUC5Oz
y4+4hsXn6zbEeG8/3MprzEOOUUFNu30ksUMNlXqGGaP/Pbye4K9g/5vm1x0xCsDn
r/u1zkrxifmBgO7+L6xTNYi0F8Sgs+QGe6UFFhYXm7ZsAkK3/FhdXYKYyI3i0UQ7
Z/GM0/8R2BM=
=3047
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce