Test ID:	1.3.6.1.4.1.25623.1.1.12.2025.7250.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-7250-1)
Summary:	The remote host is missing an update for the 'netdata' package(s) announced via the USN-7250-1 advisory.
Description:	Summary: The remote host is missing an update for the 'netdata' package(s) announced via the USN-7250-1 advisory. Vulnerability Insight: It was discovered that Netdata incorrectly handled parsing JSON input, which could lead to a JSON injection. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-18836) It was discovered that Netdata incorrectly handled parsing HTTP headers, which could lead to a HTTP header injection. An attacker could possibly use this issue to cause a denial of service or leak sensitive information. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-18837) It was discovered that Netdata incorrectly handled parsing URLs, which could lead to a log injection. An attacker could possibly use this issue to consume system resources, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-18838) It was discovered Netdata improperly authenticated API keys. An attacker could possibly use this issue to leak sensitive information or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-22497) It was discovered Fluent Bit, vendored in Netdata, incorrectly handled parsing HTTP payloads. An attacker could possibly use this issue to disrupt logging. This issue only affected Ubuntu 24.10. (CVE-2024-23722) It was discovered that WebAssembly Micro Runtime, vendored in Netdata, incorrectly handled memory. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.10. (CVE-2024-34250, CVE-2024-34251) Affected Software/OS: 'netdata' package(s) on Ubuntu 18.04, Ubuntu 20.04, Ubuntu 22.04, Ubuntu 24.10. Solution: Please install the updated package(s). CVSS Score: 5.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2018-18836 https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec96da07/web/api/web_api_v1.c#L388 https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec96da07/web/api/web_api_v1.c#L403 https://github.com/netdata/netdata/commit/92327c9ec211bd1616315abcb255861b130b97ca https://www.red4sec.com/cve/netdata_json_injection.txt Common Vulnerability Exposure (CVE) ID: CVE-2018-18837 https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec96da07/web/api/web_api_v1.c#L367-L370 https://www.red4sec.com/cve/netdata_header_injection.txt Common Vulnerability Exposure (CVE) ID: CVE-2018-18838 https://www.red4sec.com/cve/netdata_log_injection.txt Common Vulnerability Exposure (CVE) ID: CVE-2023-22497 https://github.com/netdata/netdata/releases/tag/v1.37.0 https://github.com/netdata/netdata/security/advisories/GHSA-jx85-39cw-66f2 Common Vulnerability Exposure (CVE) ID: CVE-2024-23722 https://github.com/fluent/fluent-bit/compare/v2.2.1...v2.2.2 https://medium.com/@adurands82/fluent-bit-dos-vulnerability-cve-2024-23722-4e3e74af9d00 Common Vulnerability Exposure (CVE) ID: CVE-2024-34250 https://github.com/bytecodealliance/wasm-micro-runtime/issues/3346 Common Vulnerability Exposure (CVE) ID: CVE-2024-34251 https://github.com/bytecodealliance/wasm-micro-runtime/issues/3347
Copyright	Copyright (C) 2025 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.