{ "document": { "aggregate_severity": { "text": "High" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/rhel7els/vex/2022/cve-2022-39377-els_os-rhel7els.json" } ], "tracking": { "current_release_date": "2026-04-22T17:51:51Z", "generator": { "date": "2026-04-22T17:51:51Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2022-39377-ELS_OS-RHEL7ELS", "initial_release_date": "2022-11-08T20:15:00Z", "revision_history": [ { "date": "2022-11-08T20:15:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-04-22T17:51:51Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2022-39377" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux 7", "product": { "name": "Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7", "product_identification_helper": { "cpe": "cpe:2.3:o:redhat:enterprise_linux:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "sysstat-0:10.1.5-20.el7_9.x86_64", "product": { "name": "sysstat-0:10.1.5-20.el7_9.x86_64", "product_id": "sysstat-0:10.1.5-20.el7_9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/sysstat@10.1.5-20.el7_9?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "sysstat-0:10.1.5-20.el7_9.tuxcare.els1.x86_64", "product": { "name": "sysstat-0:10.1.5-20.el7_9.tuxcare.els1.x86_64", "product_id": "sysstat-0:10.1.5-20.el7_9.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/sysstat@10.1.5-20.el7_9.tuxcare.els1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "sysstat-0:10.1.5-20.el7_9.tuxcare.els1.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:sysstat-0:10.1.5-20.el7_9.tuxcare.els1.x86_64" }, "product_reference": "sysstat-0:10.1.5-20.el7_9.tuxcare.els1.x86_64", "relates_to_product_reference": "Red-Hat-7" }, { "category": "default_component_of", "full_product_name": { "name": "sysstat-0:10.1.5-20.el7_9.x86_64 as a component of Red Hat Enterprise Linux 7", "product_id": "Red-Hat-7:sysstat-0:10.1.5-20.el7_9.x86_64" }, "product_reference": "sysstat-0:10.1.5-20.el7_9.x86_64", "relates_to_product_reference": "Red-Hat-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-39377", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" }, "notes": [ { "category": "description", "text": "sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_structures contains a size_t overflow in sa_common.c. The allocate_structures function insufficiently checks bounds before arithmetic multiplication, allowing for an overflow in the size allocated for the buffer representing system activities. This issue may lead to Remote Code Execution (RCE). This issue has been patched in version 12.7.1.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red-Hat-7:sysstat-0:10.1.5-20.el7_9.tuxcare.els1.x86_64" ], "known_affected": [ "Red-Hat-7:sysstat-0:10.1.5-20.el7_9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-39377" }, { "category": "external", "summary": "https://github.com/sysstat/sysstat/security/advisories/GHSA-q8r6-g56f-9w7x", "url": "https://github.com/sysstat/sysstat/security/advisories/GHSA-q8r6-g56f-9w7x" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2022/11/msg00014.html", "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00014.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6F26ALXWYHT4LN2AHPZM34OQEXTJE3JZ/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6F26ALXWYHT4LN2AHPZM34OQEXTJE3JZ/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7X6WKTODOUDV6M3HZMASYNZP6EM4N7W4/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7X6WKTODOUDV6M3HZMASYNZP6EM4N7W4/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHUVUDIVDJZ7AVXD3XX3NBXXXKPOKN3N/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHUVUDIVDJZ7AVXD3XX3NBXXXKPOKN3N/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202211-07", "url": "https://security.gentoo.org/glsa/202211-07" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/10/msg00017.html", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00017.html" } ], "release_date": "2022-11-08T20:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-04-22T17:51:20.910746Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1776880278", "product_ids": [ "Red-Hat-7:sysstat-0:10.1.5-20.el7_9.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1776880278" }, { "category": "none_available", "details": "Affected", "product_ids": [ "Red-Hat-7:sysstat-0:10.1.5-20.el7_9.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red-Hat-7:sysstat-0:10.1.5-20.el7_9.tuxcare.els1.x86_64", "Red-Hat-7:sysstat-0:10.1.5-20.el7_9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }