diff --git a/SOURCES/net-snmp-5.8-callback-fix.patch b/SOURCES/net-snmp-5.8-callback-fix.patch new file mode 100644 index 0000000..d82a41f --- /dev/null +++ b/SOURCES/net-snmp-5.8-callback-fix.patch @@ -0,0 +1,32 @@ +diff -urNp a/snmplib/callback.c b/snmplib/callback.c +--- a/snmplib/callback.c 2025-08-13 15:21:25.507544080 +0200 ++++ b/snmplib/callback.c 2025-08-13 15:25:01.973092935 +0200 +@@ -346,13 +346,17 @@ snmp_call_callbacks(int major, int minor + /* + * for each registered callback of type major and minor + */ +- for (scp = thecallbacks[major][minor]; scp != NULL; scp = scp->next) { ++ scp = thecallbacks[major][minor]; ++ while (scp != NULL) { ++ struct snmp_gen_callback *scp_next = scp->next; + + /* + * skip unregistered callbacks + */ +- if(NULL == scp->sc_callback) ++ if(NULL == scp->sc_callback) { ++ scp = scp_next; + continue; ++ } + + DEBUGMSGTL(("callback", "calling a callback for maj=%d min=%d\n", + major, minor)); +@@ -363,6 +367,8 @@ snmp_call_callbacks(int major, int minor + (*(scp->sc_callback)) (major, minor, caller_arg, + scp->sc_client_arg); + count++; ++ ++ scp = scp_next; + } + + DEBUGMSGTL(("callback", diff --git a/SOURCES/net-snmp-5.9-remove-assert.patch b/SOURCES/net-snmp-5.9-remove-assert.patch new file mode 100644 index 0000000..a031942 --- /dev/null +++ b/SOURCES/net-snmp-5.9-remove-assert.patch @@ -0,0 +1,23 @@ +From d8c83ff96144f0bb0945a3640ce7ac5995b91c74 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Thu, 26 Sep 2024 09:24:38 -0700 +Subject: [PATCH] libsnmp: Remove an incorrect assert statement + +See also https://github.com/net-snmp/net-snmp/issues/856. +--- + snmplib/snmpusm.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/snmplib/snmpusm.c b/snmplib/snmpusm.c +index 704f3e25b9..c9363745b7 100644 +--- a/snmplib/snmpusm.c ++++ b/snmplib/snmpusm.c +@@ -304,7 +304,6 @@ usm_clone(netsnmp_pdu *pdu, netsnmp_pdu *new_pdu) + return ret; + + if (pdu->command == SNMP_MSG_TRAP2) { +- netsnmp_assert(pdu->securityModel == SNMP_DEFAULT_SECMODEL); + ret = usm_clone_usmStateReference(ref, new_ref); + } else { + netsnmp_assert(ref == *new_ref); + diff --git a/SOURCES/net-snmp-5.9.1-create-user-usage.patch b/SOURCES/net-snmp-5.9.1-create-user-usage.patch new file mode 100644 index 0000000..65d9411 --- /dev/null +++ b/SOURCES/net-snmp-5.9.1-create-user-usage.patch @@ -0,0 +1,79 @@ +diff -urNp old/man/net-snmp-config.1.def new/man/net-snmp-config.1.def +--- old/man/net-snmp-config.1.def 2025-10-29 12:56:18.454081187 +0100 ++++ new/man/net-snmp-config.1.def 2025-10-29 13:00:28.613546708 +0100 +@@ -29,8 +29,8 @@ code for a list of available debug token + .PP + SNMP Setup commands: + .TP +-\fB\-\-create\-snmpv3\-user\fR [\-ro] [\-a authpass] [\-x privpass] +-[\-X DES|AES] [\-A MD5|SHA|SHA-512|SHA-384|SHA-256|SHA-224] [username] ++\fB\-\-create\-snmpv3\-user\fR [\-ro] [\-A authpass] [\-X privpass] ++[\-x AES|AES128|AES192|AES256] [\-a MD5|SHA|SHA-512|SHA-384|SHA-256|SHA-224] [username] + .PP + These options produce the various compilation flags needed when + building external SNMP applications: +diff -urNp old/man/net-snmp-create-v3-user.1.def new/man/net-snmp-create-v3-user.1.def +--- old/man/net-snmp-create-v3-user.1.def 2025-10-29 12:56:18.456081167 +0100 ++++ new/man/net-snmp-create-v3-user.1.def 2025-10-29 12:57:39.948255530 +0100 +@@ -3,7 +3,7 @@ + net-snmp-create-v3-user \- create a SNMPv3 user in net-snmp configuration file + .SH SYNOPSIS + .PP +-.B net-snmp-create-v3-user [-ro] [-A authpass] [-a MD5|SHA] [-X privpass] [-x DES|AES] ++.B net-snmp-create-v3-user [-ro] [-A authpass] [-a MD5|SHA|SHA-512|SHA-384|SHA-256|SHA-224] [-X privpass] [-x AES|AES128|AES192|AES256] + .B [username] + .SH DESCRIPTION + .PP +@@ -21,11 +21,11 @@ creates a user with read-only permission + \fB\-A authpass\fR + specifies the authentication password + .TP +-\fB\-a MD5|SHA\fR ++\fB\-a MD5|SHA|SHA-512|SHA-384|SHA-256|SHA-224\fR + specifies the authentication password hashing algorithm + .TP + \fB\-X privpass\fR + specifies the encryption password + .TP +-\fB\-x DES|AES\fR ++\fB\-x AES|AES128|AES192|AES256\fR + specifies the encryption algorithm +diff -urNp old/net-snmp-create-v3-user.in new/net-snmp-create-v3-user.in +--- old/net-snmp-create-v3-user.in 2025-10-29 12:56:18.425081481 +0100 ++++ new/net-snmp-create-v3-user.in 2025-10-29 12:59:41.821020779 +0100 +@@ -3,14 +3,14 @@ + # this shell script is designed to add new SNMPv3 users + # to Net-SNMP config file. + +-if @PSCMD@ | egrep ' snmpd *$' > /dev/null 2>&1 ; then +- echo "Apparently at least one snmpd demon is already running." ++if @PSCMD@ | @EGREP@ ' snmpd *$' > /dev/null 2>&1 ; then ++ echo "Apparently at least one snmpd daemon is already running." + echo "You must stop them in order to use this command." + exit 1 + fi + + Aalgorithm="MD5" +-Xalgorithm="DES" ++Xalgorithm="AES" + token=rwuser + + while test "x$done" = "x" -a "x$1" != "x" -a "x$usage" != "xyes"; do +@@ -40,7 +40,7 @@ case $1 in + Aalgorithm=$1 + shift + ;; +- md5|sha) ++ md5|sha|sha-512|sha-384|sha-256|sha-224) + Aalgorithm=$(echo "$1" | tr a-z A-Z) + shift + ;; +@@ -90,7 +90,7 @@ if test "x$usage" = "xyes"; then + echo "" + echo "Usage:" + echo " net-snmp-create-v3-user [-ro] [-A authpass] [-X privpass]" +- echo " [-a MD5|SHA|SHA-512|SHA-384|SHA-256|SHA-224] [-x DES|AES] [username]" ++ echo " [-a MD5|SHA|SHA-512|SHA-384|SHA-256|SHA-224] [-x AES|AES128|AES192|AES256] [username]" + echo "" + exit + fi diff --git a/SOURCES/net-snmp-5.9.4-revert-n-snmptrapd-log.patch b/SOURCES/net-snmp-5.9.4-revert-n-snmptrapd-log.patch new file mode 100644 index 0000000..e49d571 --- /dev/null +++ b/SOURCES/net-snmp-5.9.4-revert-n-snmptrapd-log.patch @@ -0,0 +1,12 @@ +diff -urNp a/apps/snmptrapd_log.c b/apps/snmptrapd_log.c +--- a/apps/snmptrapd_log.c 2025-09-03 15:15:12.510914175 +0200 ++++ b/apps/snmptrapd_log.c 2025-09-03 15:15:40.804731480 +0200 +@@ -590,7 +590,7 @@ realloc_handle_time_fmt(u_char ** buf, s + static + void convert_agent_addr(struct in_addr agent_addr, char *name, size_t size) + { +- const int numeric = !netsnmp_ds_get_boolean(NETSNMP_DS_APPLICATION_ID, ++ const int numeric = netsnmp_ds_get_boolean(NETSNMP_DS_APPLICATION_ID, + NETSNMP_DS_APP_NUMERIC_IP); + struct sockaddr_in sin; + diff --git a/SOURCES/net-snmp-tmpfilesd.conf b/SOURCES/net-snmp-tmpfilesd.conf new file mode 100644 index 0000000..7130bce --- /dev/null +++ b/SOURCES/net-snmp-tmpfilesd.conf @@ -0,0 +1 @@ +d /var/lib/net-snmp 0755 root root - diff --git a/SPECS/net-snmp.spec b/SPECS/net-snmp.spec index ac8cf18..f8a2ea8 100644 --- a/SPECS/net-snmp.spec +++ b/SPECS/net-snmp.spec @@ -10,7 +10,7 @@ Summary: A collection of SNMP protocol tools and libraries Name: net-snmp Version: 5.9.1 -Release: 17%{?dist}.1 +Release: 21%{?dist} Epoch: 1 License: BSD @@ -26,6 +26,7 @@ Source7: net-snmp-tmpfs.conf Source8: snmpd.service Source9: snmptrapd.service Source10: IETF-MIB-LICENSE.txt +Source11: net-snmp-tmpfilesd.conf Patch1: net-snmp-5.9-pie.patch Patch2: net-snmp-5.9-dir-fix.patch @@ -60,8 +61,12 @@ Patch30: net-snmp-5.9-rpmdb.patch Patch31: net-snmp-5.9-CVE-2022-24805-24810.patch Patch32: net-snmp-5.9.4-kernel-6.7.patch Patch33: net-snmp-5.9-deleted-iface.patch -Patch34: net-snmp-5.9.4-oob-access.patch -Patch35: net-snmp-5.9.4-tls.patch +Patch34: net-snmp-5.9.4-revert-n-snmptrapd-log.patch +Patch35: net-snmp-5.8-callback-fix.patch +Patch36: net-snmp-5.9.1-create-user-usage.patch +Patch37: net-snmp-5.9-remove-assert.patch +Patch38: net-snmp-5.9.4-oob-access.patch +Patch39: net-snmp-5.9.4-tls.patch # Modern RPM API means at least EL6 Patch101: net-snmp-5.8-modern-rpm-api.patch @@ -76,7 +81,7 @@ Requires: %{name}-agent-libs%{?_isa} = %{epoch}:%{version}-%{release} # is not valid. We can use %%post because this particular %%triggerun script # should fire just after this package is installed. %{?systemd_requires} -BuildRequires: make +BuildRequires: make BuildRequires: systemd BuildRequires: gcc BuildRequires: openssl-devel, bzip2-devel, elfutils-devel @@ -103,6 +108,8 @@ BuildRequires: perl(warnings) BuildRequires: lm_sensors-devel >= 3 %endif BuildRequires: autoconf, automake +# For _tmpfilesdir macro +BuildRequires: systemd-rpm-macros %description SNMP (Simple Network Management Protocol) is a protocol used for @@ -247,8 +254,12 @@ cp %{SOURCE10} . %patch31 -p1 -b .CVE-2022-24805-24810 %patch32 -p1 -b .kernel-6.7-fix %patch33 -p1 -b .iface -%patch34 -p1 -b .oob-access -%patch35 -p1 -b .tls +%patch34 -p1 -b .revert-n-snmptrapd-log +%patch35 -p1 -b .callback-fix +%patch36 -p1 -b .create-user-usage +%patch37 -p1 -b .remove-assert +%patch38 -p1 -b .oob-access +%patch39 -p1 -b .tls-allow %patch101 -p1 -b .modern-rpm-api %patch102 -p1 @@ -348,6 +359,7 @@ install -m 644 %SOURCE4 %{buildroot}%{_sysconfdir}/snmp/snmptrapd.conf install -d %{buildroot}%{_sysconfdir}/sysconfig install -m 644 %SOURCE5 %{buildroot}%{_sysconfdir}/sysconfig/snmpd install -m 644 %SOURCE6 %{buildroot}%{_sysconfdir}/sysconfig/snmptrapd +install -p -D -m 644 %SOURCE11 %{buildroot}%{_tmpfilesdir}/%{name}.conf # prepare /var/lib/net-snmp install -d %{buildroot}%{_localstatedir}/lib/net-snmp @@ -442,6 +454,7 @@ LD_LIBRARY_PATH=%{buildroot}/%{_libdir} make test %{_bindir}/snmpconf %{_bindir}/net-snmp-create-v3-user %{_sbindir}/* +%{_tmpfilesdir}/%{name}.conf %attr(0644,root,root) %{_mandir}/man[58]/snmp*d* %attr(0644,root,root) %{_mandir}/man5/snmp_config.5.gz %attr(0644,root,root) %{_mandir}/man5/variables* @@ -518,10 +531,22 @@ LD_LIBRARY_PATH=%{buildroot}/%{_libdir} make test %{_libdir}/libnetsnmptrapd*.so.%{soname}* %changelog -* Tue Jan 13 2026 Josef Ridky - 1:5.9.1-17.1 -- fix out of bound access issue (RHEL-137510) +* Mon Feb 02 2026 Josef Ridky - 1:5.9.1-21 +- fix creation of /var/lib/net-snmp in image mode (RHEL-132655) + +* Tue Jan 13 2026 Josef Ridky - 1:5.9.1-20 +- fix out of bound access issue (RHEL-137511) - enable PQC (RHEL-132653) +* Tue Nov 04 2025 Josef Ridky - 1:5.9.1-19 +- remove wrong assert (RHEL-122095) + +* Wed Oct 22 2025 Josef Ridky - 1:5.9.1-18 +- fix inverted usage of -n in snmptrapd (RHEL-101078) +- fix use after free issue (RHEL-121091) +- fix help and manpage for net-snmp-create-v3-user + script(RHEL-101614 and RHEL-103557) + * Tue Jul 16 2024 Josef Ridky - 1:5.9.1-17 - fix segfault with error on subcontainer (RHEL-46033)