CVE-2024-3019: Pcp: exposure of the redis server backend allows remote command execution via pmproxy
A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user.
This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually. The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface.
This issue affects PCP versions 4.3.4 and newer.
Upstream patch: https://github.com/performancecopilot/pcp/commit/3bde240a2acc85e63e2f7813330713dd9b59386e
Other sources
A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually. The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This flaw affects PCP versions 4.3.4 and newer.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3019?
CVE-2024-3019 is considered a critical vulnerability due to its potential for remote command execution.
How do I fix CVE-2024-3019?
To fix CVE-2024-3019, ensure that pmproxy is not running and consider applying any available security patches.
What vulnerability does CVE-2024-3019 describe?
CVE-2024-3019 describes a configuration flaw in PCP that exposes the Redis server backend to the local network.
What products are affected by CVE-2024-3019?
CVE-2024-3019 affects Performance Co-Pilot PCP versions starting from 4.3.4.
Can CVE-2024-3019 be exploited remotely?
Yes, CVE-2024-3019 can be exploited remotely, specifically when pmproxy is running.