Most recent entries from all

ALSA-2024:2566 — Important: pcp security, bug fix, and enhancement update

Affected: AlmaLinux:9: pcp, AlmaLinux:9: pcp-conf, AlmaLinux:9: pcp-devel, AlmaLinux:9: pcp-doc, AlmaLinux:9: pcp-export-pcp2elasticsearch, AlmaLinux:9: pcp-export-pcp2graphite, AlmaLinux:9: pcp-export-pcp2influxdb, AlmaLinux:9: pcp-export-pcp2json, AlmaLinux:9: pcp-export-pcp2spark, AlmaLinux:9: pcp-export-pcp2xml and 94 more

Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems.

Security Fix(es):

* pcp: exposure of the redis server backend allows remote command execution via pmproxy (CVE-2024-3019)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-02823

certfr-2024-avi-0579 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2024-avi-0579

EUVD-2026-261409

fkie_cve-2024-3019

A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually. The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This flaw affects PCP versions 4.3.4 and newer.

GHSA-g58w-wr93-q367

gsd-2024-3019

OESA-2024-1435 — pcp security update

Affected: openEuler:22.03-LTS-SP3: pcp

PCP provides a range of services that may be used to monitor and manage system performance. These services are distributed and scalable to accommodate the most complex system configurations and performance problems. Security Fix(es): A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually. The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This flaw affects PCP versions 4.3.4 and newer.(CVE-2024-3019)

RHSA-2024:2566 — Red Hat Security Advisory: pcp security, bug fix, and enhancement update

pcp: exposure of the redis server backend allows remote command execution via pmproxy

RHSA-2024:3321 — Red Hat Security Advisory: pcp security update

pcp: exposure of the redis server backend allows remote command execution via pmproxy

SUSE-SU-2024:3533-1 — Security update for pcp

Security update for pcp

UBUNTU-CVE-2024-3019

Affected: Ubuntu:16.04:LTS: pcp, Ubuntu:18.04:LTS: pcp, Ubuntu:20.04:LTS: pcp, Ubuntu:22.04:LTS: pcp, Ubuntu:24.04:LTS: pcp, Ubuntu:25.10: pcp, Ubuntu:26.04:LTS: pcp

WID-SEC-W-2024-1003 — Red Hat Enterprise Linux: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, Cross-Site Scripting (XSS)-Angriffe durchzuführen oder einen Men-in-the-Middle-Angriff auszuführen.