PatchTheCVEcollectd vulnerabilities and fixes
Recent CVEs affecting collectd, with upgrade or downgrade steps. 3 tracked.
collectd has 3 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2018-03-19. Highest priority: CVE-2017-16820 (score 62/100).
- CVE-2017-7401 HIGH 7.5 UPGRADE Incorrect interaction of the parse_packet() and parse_part_sign_sha256() functions in network.c in collectd 5.
- CVE-2017-18240 MEDIUM 5.5 UPGRADE The Gentoo app-admin/collectd package before 5.7.2-r1 sets the ownership of PID file directory to the collectd
- CVE-2017-16820 CRITICAL 9.8 UPGRADE The csnmp_read_table function in snmp.c in the SNMP plugin in collectd before 5.6.3 is susceptible to a double
FAQ
How do I fix collectd vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is collectd being exploited right now?
None of the tracked collectd CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which collectd CVE should I patch first?
CVE-2017-16820 currently ranks highest (62/100): The csnmp_read_table function in snmp.c in the SNMP plugin in collectd before 5.6.3 is susceptible to a double.