Vulnerability-Lookup

OESA-2025-1294 (CVE-2024-45769)

Vulnerability from osv_openeuler – Published: 2025-03-21 11:08 – Updated: 2026-08-06 11:08 – Source website

Summary

pcp security update

Details

PCP provides a range of services that may be used to monitor and manage system performance. These services are distributed and scalable to accommodate the most complex system configurations and performance problems.

Security Fix(es):

A vulnerability was found in Performance Co-Pilot (PCP). This flaw allows an attacker to send specially crafted data to the system, which could cause the program to misbehave or crash.(CVE-2024-45769)

A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges.(CVE-2024-45770)

Severity

5.5 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-45769	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-45770	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "pcp-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-conf-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-debuginfo-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-debugsource-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-devel-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-export-pcp2elasticsearch-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-export-pcp2graphite-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-export-pcp2influxdb-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-export-pcp2json-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-export-pcp2spark-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-export-pcp2xml-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-export-pcp2zabbix-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-export-zabbix-agent-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-gui-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-import-collectl2pcp-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-import-ganglia2pcp-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-import-iostat2pcp-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-import-mrtg2pcp-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-import-sar2pcp-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-activemq-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-apache-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-bash-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-bind2-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-bonding-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-bpf-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-bpftrace-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-cifs-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-cisco-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-dbping-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-denki-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-dm-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-docker-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-ds389-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-ds389log-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-elasticsearch-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-gfs2-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-gluster-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-gpfs-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-gpsd-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-hacluster-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-haproxy-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-infiniband-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-json-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-libvirt-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-lio-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-lmsensors-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-logger-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-lustre-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-lustrecomm-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-mailq-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-memcache-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-mic-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-mongodb-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-mounts-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-mysql-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-named-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-netcheck-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-netfilter-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-news-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-nfsclient-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-nginx-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-nutcracker-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-nvidia-gpu-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-openmetrics-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-openvswitch-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-oracle-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-pdns-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-perfevent-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-podman-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-postfix-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-postgresql-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-rabbitmq-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-redis-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-roomtemp-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-rsyslog-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-samba-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-sendmail-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-shping-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-slurm-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-smart-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-snmp-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-sockets-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-summary-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-systemd-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-trace-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-unbound-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-weblog-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-zimbra-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-pmda-zswap-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-selinux-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-system-tools-5.3.7-7.oe2203sp4.aarch64.rpm",
          "pcp-zeroconf-5.3.7-7.oe2203sp4.aarch64.rpm",
          "perl-PCP-LogImport-5.3.7-7.oe2203sp4.aarch64.rpm",
          "perl-PCP-LogSummary-5.3.7-7.oe2203sp4.aarch64.rpm",
          "perl-PCP-MMV-5.3.7-7.oe2203sp4.aarch64.rpm",
          "perl-PCP-PMDA-5.3.7-7.oe2203sp4.aarch64.rpm",
          "python3-pcp-5.3.7-7.oe2203sp4.aarch64.rpm"
        ],
        "noarch": [
          "pcp-help-5.3.7-7.oe2203sp4.noarch.rpm"
        ],
        "src": [
          "pcp-5.3.7-7.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "pcp-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-conf-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-debuginfo-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-debugsource-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-devel-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-export-pcp2elasticsearch-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-export-pcp2graphite-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-export-pcp2influxdb-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-export-pcp2json-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-export-pcp2spark-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-export-pcp2xml-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-export-pcp2zabbix-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-export-zabbix-agent-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-gui-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-import-collectl2pcp-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-import-ganglia2pcp-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-import-iostat2pcp-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-import-mrtg2pcp-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-import-sar2pcp-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-activemq-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-apache-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-bash-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-bcc-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-bind2-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-bonding-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-bpf-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-bpftrace-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-cifs-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-cisco-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-dbping-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-denki-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-dm-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-docker-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-ds389-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-ds389log-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-elasticsearch-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-gfs2-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-gluster-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-gpfs-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-gpsd-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-hacluster-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-haproxy-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-infiniband-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-json-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-libvirt-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-lio-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-lmsensors-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-logger-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-lustre-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-lustrecomm-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-mailq-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-memcache-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-mic-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-mongodb-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-mounts-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-mssql-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-mysql-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-named-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-netcheck-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-netfilter-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-news-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-nfsclient-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-nginx-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-nutcracker-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-nvidia-gpu-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-openmetrics-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-openvswitch-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-oracle-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-pdns-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-perfevent-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-podman-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-postfix-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-postgresql-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-rabbitmq-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-redis-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-roomtemp-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-rsyslog-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-samba-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-sendmail-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-shping-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-slurm-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-smart-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-snmp-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-sockets-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-summary-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-systemd-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-trace-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-unbound-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-weblog-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-zimbra-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-pmda-zswap-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-selinux-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-system-tools-5.3.7-7.oe2203sp4.x86_64.rpm",
          "pcp-zeroconf-5.3.7-7.oe2203sp4.x86_64.rpm",
          "perl-PCP-LogImport-5.3.7-7.oe2203sp4.x86_64.rpm",
          "perl-PCP-LogSummary-5.3.7-7.oe2203sp4.x86_64.rpm",
          "perl-PCP-MMV-5.3.7-7.oe2203sp4.x86_64.rpm",
          "perl-PCP-PMDA-5.3.7-7.oe2203sp4.x86_64.rpm",
          "python3-pcp-5.3.7-7.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "pcp",
        "purl": "pkg:rpm/openEuler/pcp\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.3.7-7.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "PCP provides a range of services that may be used to monitor and manage system performance. These services are distributed and scalable to accommodate the most complex system configurations and performance problems.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in Performance Co-Pilot (PCP).\u00a0 This flaw allows an attacker to send specially crafted data to the system, which could cause the program to misbehave or crash.(CVE-2024-45769)\n\nA vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges.(CVE-2024-45770)",
  "id": "OESA-2025-1294",
  "modified": "2026-08-06T11:08:23Z",
  "published": "2025-03-21T11:08:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1294"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45769"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45770"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pcp security update",
  "upstream": [
    "CVE-2024-45769",
    "CVE-2024-45770"
  ]
}

CVE-2024-45769 (GCVE-0-2024-45769)

Vulnerability from cvelistv5 – Published: 2024-09-19 08:45 – Updated: 2025-11-20 19:06

Title

Pcp: pmcd heap corruption through metric pmstore operations

Summary

A vulnerability was found in Performance Co-Pilot (PCP). This flaw allows an attacker to send specially crafted data to the system, which could cause the program to misbehave or crash.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-19 13:39 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

redhat redhat root Scorecard

References

11 references

URL	Tags
https://access.redhat.com/errata/RHSA-2024:6837	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:6840	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:6842	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:6843	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:6844	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:6846	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:6847	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:6848	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:9452	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-45769	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2310452	issue-trackingx_refsource_REDHAT

Impacted products

17 products

Vendor	Product	Version

Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:5.3.7-22.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:5.0.2-9.el8_2 , < * (rpm) cpe:/a:redhat:rhel_aus:8.2::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:5.2.5-8.el8_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	Unaffected: 0:5.2.5-8.el8_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	Unaffected: 0:5.2.5-8.el8_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:5.3.5-10.el8_6 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:5.3.5-10.el8_6 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:5.3.5-10.el8_6 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream cpe:/a:redhat:rhel_aus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 0:5.3.7-19.el8_8 , < * (rpm) cpe:/a:redhat:rhel_eus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:6.2.0-5.el9_4 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:6.2.2-7.el9_5 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:5.3.5-10.el9_0 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 0:6.0.1-8.el9_2 , < * (rpm) cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7

Date Public

2024-09-17 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45769",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-19T13:39:40.637961Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-19T13:39:52.390Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/performancecopilot/pcp",
          "defaultStatus": "affected",
          "packageName": "pcp"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.3.7-22.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.0.2-9.el8_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/a:redhat:rhel_aus:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.2.5-8.el8_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/a:redhat:rhel_aus:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.2.5-8.el8_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/a:redhat:rhel_aus:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.2.5-8.el8_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/a:redhat:rhel_aus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.3.5-10.el8_6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/a:redhat:rhel_aus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.3.5-10.el8_6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream",
            "cpe:/a:redhat:rhel_aus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.3.5-10.el8_6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.3.7-19.el8_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:6.2.0-5.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:6.2.2-7.el9_5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.3.5-10.el9_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:6.0.1-8.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2024-09-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Performance Co-Pilot (PCP).\u00a0 This flaw allows an attacker to send specially crafted data to the system, which could cause the program to misbehave or crash."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-20T19:06:14.387Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2024:6837",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6837"
        },
        {
          "name": "RHSA-2024:6840",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6840"
        },
        {
          "name": "RHSA-2024:6842",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6842"
        },
        {
          "name": "RHSA-2024:6843",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6843"
        },
        {
          "name": "RHSA-2024:6844",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6844"
        },
        {
          "name": "RHSA-2024:6846",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6846"
        },
        {
          "name": "RHSA-2024:6847",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6847"
        },
        {
          "name": "RHSA-2024:6848",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6848"
        },
        {
          "name": "RHSA-2024:9452",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9452"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-45769"
        },
        {
          "name": "RHBZ#2310452",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310452"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-09-06T17:07:45.533Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-09-17T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Pcp: pmcd heap corruption through metric pmstore operations",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_redhatCweChain": "CWE-787: Out-of-bounds Write"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-45769",
    "datePublished": "2024-09-19T08:45:06.247Z",
    "dateReserved": "2024-09-06T14:56:44.790Z",
    "dateUpdated": "2025-11-20T19:06:14.387Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-45770 (GCVE-0-2024-45770)

Vulnerability from cvelistv5 – Published: 2024-09-19 08:45 – Updated: 2025-11-20 19:06

Title

Pcp: pmpost symlink attack allows escalating pcp to root user

Summary

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-19 13:39 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

redhat redhat root Scorecard

References

11 references

URL	Tags
https://access.redhat.com/errata/RHSA-2024:6837	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:6840	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:6842	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:6843	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:6844	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:6846	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:6847	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:6848	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:9452	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-45770	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2310451	issue-trackingx_refsource_REDHAT

Impacted products

17 products

Vendor	Product	Version

Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:5.3.7-22.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:5.0.2-9.el8_2 , < * (rpm) cpe:/a:redhat:rhel_aus:8.2::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:5.2.5-8.el8_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	Unaffected: 0:5.2.5-8.el8_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	Unaffected: 0:5.2.5-8.el8_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:5.3.5-10.el8_6 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:5.3.5-10.el8_6 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:5.3.5-10.el8_6 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_e4s:8.6::appstream cpe:/a:redhat:rhel_tus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 0:5.3.7-19.el8_8 , < * (rpm) cpe:/a:redhat:rhel_eus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:6.2.0-5.el9_4 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:6.2.2-7.el9_5 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:5.3.5-10.el9_0 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 0:6.0.1-8.el9_2 , < * (rpm) cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7

Date Public

2024-09-17 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45770",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-19T13:39:14.632000Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-19T13:39:25.166Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/performancecopilot/pcp",
          "defaultStatus": "affected",
          "packageName": "pcp"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.3.7-22.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.0.2-9.el8_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.2.5-8.el8_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.2.5-8.el8_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.2.5-8.el8_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.3.5-10.el8_6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.3.5-10.el8_6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_e4s:8.6::appstream",
            "cpe:/a:redhat:rhel_tus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.3.5-10.el8_6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.3.7-19.el8_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:6.2.0-5.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:6.2.2-7.el9_5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.3.5-10.el9_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:6.0.1-8.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "pcp",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2024-09-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-20T19:06:09.494Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2024:6837",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6837"
        },
        {
          "name": "RHSA-2024:6840",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6840"
        },
        {
          "name": "RHSA-2024:6842",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6842"
        },
        {
          "name": "RHSA-2024:6843",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6843"
        },
        {
          "name": "RHSA-2024:6844",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6844"
        },
        {
          "name": "RHSA-2024:6846",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6846"
        },
        {
          "name": "RHSA-2024:6847",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6847"
        },
        {
          "name": "RHSA-2024:6848",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6848"
        },
        {
          "name": "RHSA-2024:9452",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9452"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-45770"
        },
        {
          "name": "RHBZ#2310451",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310451"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-09-06T17:11:36.280Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-09-17T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Pcp: pmpost symlink attack allows escalating pcp to root user",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-45770",
    "datePublished": "2024-09-19T08:45:37.303Z",
    "dateReserved": "2024-09-06T14:56:44.790Z",
    "dateUpdated": "2025-11-20T19:06:09.494Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OESA-2025-1294 (CVE-2024-45769)

CVE-2024-45769 (GCVE-0-2024-45769)

CVE-2024-45770 (GCVE-0-2024-45770)

Tags

Sightings

Nomenclature

Related by attack behaviour