High 8.8

PCPの脆弱性、pmproxy経由で遠隔からコマンドを実行されるおそれ

CVE-2024-3019 First seen on SecPulse Mar 29, 2024

Summary

2024年3月に公表された、PCPのpmproxyの設定に関する脆弱性です。既定の設定ではRedisサーバーのバックエンドがローカルネットワークに公開され、Redisユーザーの権限で遠隔からコマンドを実行されるおそれがあります。影響はバージョン4.3.4以降で、修正版は公表されていません。pmproxyは既定では停止しており、起動している場合のみ悪用できるため、pmproxyを使っているかを確認し、不要であれば停止したうえで最新の情報を確認してください。

AI summary

Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
GitHub	GitHubpcp	≥ 4.3.4 (no fix yet)→ Not listed	Not listed
Red Hat	Red HatRed Hat Enterprise Linux 8	—	Not listed
Red Hat	Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support	—	Not listed
Red Hat	Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	—	Not listed
Red Hat	Red HatRed Hat Enterprise Linux 8.4 Telecommunications Update Service	—	Not listed
Red Hat	Red HatRed Hat Enterprise Linux 8.4 Update Services for SAP Solutions	—	Not listed
Red Hat	Red HatRed Hat Enterprise Linux 8.6 Extended Update Support	—	Not listed
Red Hat	Red HatRed Hat Enterprise Linux 8.8 Extended Update Support	—	Not listed
Red Hat	Red HatRed Hat Enterprise Linux 9	—	Not listed
Red Hat	Red HatRed Hat Enterprise Linux 9.0 Extended Update Support	—	Not listed
Red Hat	Red HatRed Hat Enterprise Linux 9.2 Extended Update Support	—	Not listed
Red Hat	Red HatRed Hat Enterprise Linux 10	—	Not listed
Red Hat	Red HatRed Hat Enterprise Linux 6	—	Not listed
Red Hat	Red HatRed Hat Enterprise Linux 7	—	Not listed

This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.

Fix status by distribution

Records published by each distribution for this CVE. Fixed versions differ by release; check each link.

Debian DEBIAN-CVE-2024-3019 pcp Fix available
Ubuntu UBUNTU-CVE-2024-3019 pcp No fixed version in this record

Original description The description as published by the source.

A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually. The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This flaw affects PCP versions 4.3.4 and newer.

Source: CVE.org (CVE Program・cvelistV5) NVD

Summary

AI summary

Affected packages

Fix status by distribution

References