CVE-2019-20892
Fixed in a distro release EPSS 2%
net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions, but might not affect an upstream release.
Products: net-snmp, oracle zfs_storage_appliance_kit
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.11 | net-snmp | 5.8-r0 |
| Alpine 3.12 | net-snmp | 5.8-r0 |
| Debian 12 | net-snmp | 5.8+dfsg-3 |
| Debian 13 | net-snmp | 5.8+dfsg-3 |
| Debian 14 | net-snmp | 5.8+dfsg-3 |
| Red Hat Enterprise Linux 8 | net-snmp | 1:5.8-12.el8_1.1 |
| Red Hat Enterprise Linux 8 | net-snmp-agent-libs | 1:5.8-12.el8_1.1 |
| Red Hat Enterprise Linux 8 | net-snmp-agent-libs-debuginfo | 1:5.8-12.el8_1.1 |
| Red Hat Enterprise Linux 8 | net-snmp-debuginfo | 1:5.8-12.el8_1.1 |
| Red Hat Enterprise Linux 8 | net-snmp-debugsource | 1:5.8-12.el8_1.1 |
| Red Hat Enterprise Linux 8 | net-snmp-devel | 1:5.8-12.el8_1.1 |
| Red Hat Enterprise Linux 8 | net-snmp-libs | 1:5.8-12.el8_1.1 |
| Red Hat Enterprise Linux 8 | net-snmp-libs-debuginfo | 1:5.8-12.el8_1.1 |
| Red Hat Enterprise Linux 8 | net-snmp-perl-debuginfo | 1:5.8-12.el8_1.1 |
| Red Hat Enterprise Linux 8 | net-snmp-utils | 1:5.8-12.el8_1.1 |
| Red Hat Enterprise Linux 8 | net-snmp-utils-debuginfo | 1:5.8-12.el8_1.1 |
| Ubuntu 20.04 LTS | net-snmp | 5.8+dfsg-2ubuntu2.1 |