p PatchFirst

CVE-2024-42332

CVE-2024-42332 · New line injection in Zabbix SNMP traps

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This attack requires SNMP auth to be off and/or the attacker to know the community/auth details. The attack requires an SNMP item to be configured as text on the target host.

CVSS 3.7 · Low · EPSS 0.6% · Fix available

Published
Updated

Stack: system · applications

Affected products and versions

  • zabbix

    Versions
    • ≥ 6.0.0, < 6.0.34: Affected; ≥ 6.0.35rc1: Not affected (git)
    • ≥ 6.4.0, < 6.4.19: Affected; ≥ 6.4.20rc1: Not affected (git)
    • ≥ 7.0.0, < 7.0.4: Affected; ≥ 7.0.5rc1: Not affected (git)

    Update to 6.0.35rc1; Update to 6.4.20rc1; Update to 7.0.5rc1

  • zabbix Debian:12

    Versions
    • 1:6.0.14+dfsg-1
    • 1:6.0.23+dfsg-1
    • 1:6.0.23+dfsg-1~bpo12+1
    • 1:6.0.24+dfsg-1
    • 1:6.0.25+dfsg-1
    • 1:6.0.29+dfsg-1
    • 1:7.0.0+dfsg-1
    • 1:7.0.0+dfsg-2
    • 1:7.0.0+dfsg-2~bpo12+1
    • 1:7.0.1+dfsg-1
    • 1:7.0.1+dfsg-1~bpo12+1
    • 1:7.0.10+dfsg-1
    • 1:7.0.10+dfsg-2
    • 1:7.0.2+dfsg-1
    • 1:7.0.2+dfsg-1~bpo12+1
    • 1:7.0.22+dfsg-1
    • 1:7.0.22+dfsg-1.1
    • 1:7.0.22+dfsg-1~bpo13+1
    • 1:7.0.22+dfsg-1~deb13u1
    • 1:7.0.27+dfsg-1
    • 1:7.0.29+dfsg-1
    • 1:7.0.29+dfsg-2
    • 1:7.0.3+dfsg-1
    • 1:7.0.5+dfsg-1
    • 1:7.0.5+dfsg-1~bpo12+1
    • 1:7.0.6+dfsg-1
    • 1:7.0.9+dfsg-1
    • 1:7.0.9+dfsg-1~bpo12+1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zabbix Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:7.0.5+dfsg-1

    Update to 1:7.0.5+dfsg-1

  • zabbix Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:7.0.5+dfsg-1

    Update to 1:7.0.5+dfsg-1

  • zabbix Ubuntu:Pro:14.04:LTS

    Versions
    • 1:2.0.6+dfsg-1ubuntu2
    • 1:2.2.0+dfsg-1ubuntu1
    • 1:2.2.0+dfsg-6ubuntu1
    • 1:2.2.1+dfsg-1ubuntu3
    • 1:2.2.2+dfsg-1ubuntu1
    • 1:2.2.2+dfsg-1ubuntu1+esm1
    • 1:2.2.2+dfsg-1ubuntu1+esm3
    • 1:2.2.2+dfsg-1ubuntu1+esm4
    • 1:2.2.2+dfsg-1ubuntu1+esm5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zabbix Ubuntu:Pro:16.04:LTS

    Versions
    • 1:2.4.6+dfsg-1
    • 1:2.4.7+dfsg-1
    • 1:2.4.7+dfsg-2
    • 1:2.4.7+dfsg-2ubuntu2
    • 1:2.4.7+dfsg-2ubuntu2.1
    • 1:2.4.7+dfsg-2ubuntu2.1+esm1
    • 1:2.4.7+dfsg-2ubuntu2.1+esm2
    • 1:2.4.7+dfsg-2ubuntu2.1+esm3
    • 1:2.4.7+dfsg-2ubuntu2.1+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zabbix Ubuntu:Pro:18.04:LTS

    Versions
    • 1:3.0.7+dfsg-3
    • 1:3.0.12+dfsg-1
    • 1:3.0.12+dfsg-1ubuntu0.1~esm1
    • 1:3.0.12+dfsg-1ubuntu0.1~esm2
    • 1:3.0.12+dfsg-1ubuntu0.1~esm3
    • 1:3.0.12+dfsg-1ubuntu0.1~esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zabbix Ubuntu:Pro:20.04:LTS

    Versions
    • 1:4.0.4+dfsg-1build2
    • 1:4.0.4+dfsg-1build3
    • 1:4.0.11+dfsg-1
    • 1:4.0.14+dfsg-1
    • 1:4.0.15+dfsg-1
    • 1:4.0.16+dfsg-1
    • 1:4.0.16+dfsg-1build1
    • 1:4.0.17+dfsg-1
    • 1:4.0.17+dfsg-1ubuntu0.1~esm1
    • 1:4.0.17+dfsg-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • zabbix Ubuntu:Pro:22.04:LTS

    Versions
    • 1:5.0.8+dfsg-1build1
    • 1:5.0.14+dfsg-1
    • 1:5.0.17+dfsg-1
    • 1:5.0.17+dfsg-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →