Link Following Affecting pcp-export-zabbix-agent package, versions <0:6.2.2-7.el9_5


Severity

Recommended
0.0
medium
0
10

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.04% (6th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE9-PCPEXPORTZABBIXAGENT-8067818
  • published21 Sept 2024
  • disclosed19 Sept 2024

Introduced: 19 Sep 2024

CVE-2024-45770  (opens in a new tab)
CWE-59  (opens in a new tab)

How to fix?

Upgrade Oracle:9 pcp-export-zabbix-agent to version 0:6.2.2-7.el9_5 or higher.
This issue was patched in ELSA-2024-9452.

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcp-export-zabbix-agent package and not the pcp-export-zabbix-agent package as distributed by Oracle. See How to fix? for Oracle:9 relevant fixed versions and status.

A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges.

CVSS Scores

version 3.1