rpm package
almalinux/pcp-pmda-hdb
pkg:rpm/almalinux/pcp-pmda-hdb
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-16529 | Hig | 7.5 | < 7.0.3-5.el10_2 | 7.0.3-5.el10_2 | Jul 30, 2026 | A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads. | |
| CVE-2026-16527 | Hig | 7.3 | < 7.0.3-5.el10_2 | 7.0.3-5.el10_2 | Jul 30, 2026 | An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover. | |
| CVE-2026-16526 | Hig | 8.8 | < 7.0.3-5.el10_2 | 7.0.3-5.el10_2 | Jul 30, 2026 | A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root. | |
| CVE-2026-16524 | Hig | 7.8 | < 7.0.3-5.el10_2 | 7.0.3-5.el10_2 | Jul 30, 2026 | A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh. |
- affected < 7.0.3-5.el10_2fixed 7.0.3-5.el10_2
A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.
- affected < 7.0.3-5.el10_2fixed 7.0.3-5.el10_2
An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.
- affected < 7.0.3-5.el10_2fixed 7.0.3-5.el10_2
A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.
- affected < 7.0.3-5.el10_2fixed 7.0.3-5.el10_2
A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.