RedHat: RHSA-2018-1605:01 Moderate: collectd security update
Summary
Red Hat OpenStack Platform Operational Tools provides the facilities for
monitoring a private or public Red Hat OpenStack Platform cloud.
collectd is a small C-language daemon, which reads various system metrics
periodically and updates RRD files (creating them if necessary). Because
the daemon does not start up each time it updates files, it has a low
system footprint.
Security fix:
* collectd: double free in csnmp_read_table function in snmp.c
(CVE-2017-16820)
For more details about the security issue, including impact, a CVSS score,
and other related information, refer to the CVE page listed in the
References section.
Summary
Solution
Before applying this update, ensure all previously released errata relevant
to your system have been applied.
Red Hat OpenStack Platform 10 runs on Red Hat Enterprise Linux 7.5.
The Red Hat OpenStack Platform 10 Release Notes contain the following:
* An explanation of the way in which the provided components interact to
form a working cloud computing environment.
* Technology Previews, Recommended Practices, and Known Issues.
* The channels required for Red Hat OpenStack Platform 10, including which
channels need to be enabled and disabled.
The Release Notes are available at:
This update is available through 'yum update' on systems registered through
Red Hat Subscription Manager. For more information about Red Hat
Subscription Manager, see:
nt/1/html/RHSM/index.html
References
https://access.redhat.com/security/cve/CVE-2017-16820 https://access.redhat.com/security/updates/classification/#moderate
Package List
Red Hat OpenStack Platform 10.0 Operational Tools for RHEL 7:
Source:
collectd-5.8.0-10.el7ost.src.rpm
intel-cmt-cat-1.0.1-1.el7ost.src.rpm
x86_64:
collectd-5.8.0-10.el7ost.x86_64.rpm
collectd-apache-5.8.0-10.el7ost.x86_64.rpm
collectd-ascent-5.8.0-10.el7ost.x86_64.rpm
collectd-bind-5.8.0-10.el7ost.x86_64.rpm
collectd-ceph-5.8.0-10.el7ost.x86_64.rpm
collectd-curl-5.8.0-10.el7ost.x86_64.rpm
collectd-curl_json-5.8.0-10.el7ost.x86_64.rpm
collectd-curl_xml-5.8.0-10.el7ost.x86_64.rpm
collectd-dbi-5.8.0-10.el7ost.x86_64.rpm
collectd-debuginfo-5.8.0-10.el7ost.x86_64.rpm
collectd-disk-5.8.0-10.el7ost.x86_64.rpm
collectd-dns-5.8.0-10.el7ost.x86_64.rpm
collectd-drbd-5.8.0-10.el7ost.x86_64.rpm
collectd-email-5.8.0-10.el7ost.x86_64.rpm
collectd-generic-jmx-5.8.0-10.el7ost.x86_64.rpm
collectd-ipmi-5.8.0-10.el7ost.x86_64.rpm
collectd-iptables-5.8.0-10.el7ost.x86_64.rpm
collectd-ipvs-5.8.0-10.el7ost.x86_64.rpm
collectd-java-5.8.0-10.el7ost.x86_64.rpm
collectd-log_logstash-5.8.0-10.el7ost.x86_64.rpm
collectd-mcelog-5.8.0-10.el7ost.x86_64.rpm
collectd-memcachec-5.8.0-10.el7ost.x86_64.rpm
collectd-mysql-5.8.0-10.el7ost.x86_64.rpm
collectd-netlink-5.8.0-10.el7ost.x86_64.rpm
collectd-nginx-5.8.0-10.el7ost.x86_64.rpm
collectd-notify_email-5.8.0-10.el7ost.x86_64.rpm
collectd-openldap-5.8.0-10.el7ost.x86_64.rpm
collectd-ovs-events-5.8.0-10.el7ost.x86_64.rpm
collectd-ovs-stats-5.8.0-10.el7ost.x86_64.rpm
collectd-ping-5.8.0-10.el7ost.x86_64.rpm
collectd-postgresql-5.8.0-10.el7ost.x86_64.rpm
collectd-python-5.8.0-10.el7ost.x86_64.rpm
collectd-rdt-5.8.0-10.el7ost.x86_64.rpm
collectd-rrdcached-5.8.0-10.el7ost.x86_64.rpm
collectd-rrdtool-5.8.0-10.el7ost.x86_64.rpm
collectd-sensors-5.8.0-10.el7ost.x86_64.rpm
collectd-smart-5.8.0-10.el7ost.x86_64.rpm
collectd-snmp-5.8.0-10.el7ost.x86_64.rpm
collectd-snmp-agent-5.8.0-10.el7ost.x86_64.rpm
collectd-turbostat-5.8.0-10.el7ost.x86_64.rpm
collectd-utils-5.8.0-10.el7ost.x86_64.rpm
collectd-virt-5.8.0-10.el7ost.x86_64.rpm
collectd-write_http-5.8.0-10.el7ost.x86_64.rpm
collectd-write_sensu-5.8.0-10.el7ost.x86_64.rpm
collectd-write_tsdb-5.8.0-10.el7ost.x86_64.rpm
collectd-zookeeper-5.8.0-10.el7ost.x86_64.rpm
intel-cmt-cat-1.0.1-1.el7ost.x86_64.rpm
libcollectdclient-5.8.0-10.el7ost.x86_64.rpm
perl-Collectd-5.8.0-10.el7ost.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
Topic
Updated collectd packages are now available for Red Hat OpenStack Platform10.0 Operational Tools for RHEL 7.Red Hat Product Security has rated this update as having a security impactofModerate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Red Hat OpenStack Platform 10.0 Operational Tools for RHEL 7 - x86_64
Bugs Fixed
1516447 - CVE-2017-16820 collectd: double free in csnmp_read_table function in snmp.c
1550149 - [UPDATES]Failed to on dependencies if collectd sub-packages are installed