Ubuntu Security Update USN-7966-2: Telegraf vulnerabilities

[LinuxBot]

USN-7966-1 fixed vulnerabilities in Snowflake. This update provides the corresponding updates for Telegraf. Original advisory details: It was discovered that Pion DTLS, vendored in Telegraf, did not impose a limit on the amount of data that was buffered during the handshake. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29189) It was discovered that Pion DTLS, vendored in Telegraf, did not prevent the fragmentBuffer from processing zero length fragments. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29190) It was discovered that Pion DTLS, vendored in Telegraf, did not require CertificateVerify when Client Cert was sent. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29222)

Continue reading...