Debian Package Tracker
Register | Log in
Subscribe

pcp

System level performance monitoring and performance management

Choose email to subscribe with

general
  • source: pcp (main)
  • version: 7.2.2-1
  • maintainer: PCP Development Team (DMD)
  • uploaders: Nathan Scott (DMD) – Ken McDonell (DMD)
  • arch: all any
  • std-ver: 4.7.2
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 5.2.6-1
  • oldstable: 6.0.3-1.1
  • stable: 6.3.8-1
  • testing: 7.2.2-1
  • unstable: 7.2.2-1
versioned links
  • 5.2.6-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 6.0.3-1.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 6.3.8-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 7.2.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • libpcp-archive1
  • libpcp-archive1-dev
  • libpcp-gui2
  • libpcp-gui2-dev
  • libpcp-import-perl
  • libpcp-import1
  • libpcp-import1-dev
  • libpcp-import2
  • libpcp-import2-dev
  • libpcp-logsummary-perl
  • libpcp-mmv-perl
  • libpcp-mmv1
  • libpcp-mmv1-dev
  • libpcp-pmda-perl
  • libpcp-pmda3
  • libpcp-pmda3-dev
  • libpcp-trace2
  • libpcp-trace2-dev
  • libpcp-web1
  • libpcp-web1-dev
  • libpcp3
  • libpcp3-dev
  • libpcp4
  • libpcp4-dev
  • pcp (2 bugs: 0, 2, 0, 0)
  • pcp-atop
  • pcp-conf
  • pcp-doc
  • pcp-dstat (1 bugs: 0, 1, 0, 0)
  • pcp-export-pcp2elasticsearch
  • pcp-export-pcp2graphite
  • pcp-export-pcp2influxdb
  • pcp-export-pcp2json
  • pcp-export-pcp2spark
  • pcp-export-pcp2xlsx
  • pcp-export-pcp2xml
  • pcp-export-pcp2zabbix
  • pcp-export-zabbix-agent
  • pcp-gui
  • pcp-htop
  • pcp-import-benchmarks
  • pcp-import-collectl2pcp
  • pcp-import-ganglia2pcp
  • pcp-import-guidellm2pcp
  • pcp-import-iostat2pcp
  • pcp-import-mrtg2pcp
  • pcp-import-sar2pcp
  • pcp-import-sheet2pcp
  • pcp-pmda-infiniband
  • pcp-testsuite (1 bugs: 0, 1, 0, 0)
  • pcp-zeroconf
  • python3-pcp
action needed
10 security issues in bookworm high

There are 10 open security issues in bookworm.

6 important issues:
  • CVE-2026-16524: A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.
  • CVE-2026-16526: A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.
  • CVE-2026-16527: An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.
  • CVE-2026-16529: A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.
  • CVE-2026-16530: A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.
  • CVE-2026-16531: An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.
4 issues postponed or untriaged:
  • CVE-2023-6917: (needs triaging) A vulnerability has been identified in the Performance Co-Pilot (PCP) package, stemming from the mixed privilege levels utilized by systemd services associated with PCP. While certain services operate within the confines of limited PCP user/group privileges, others are granted full root privileges. This disparity in privilege levels poses a risk when privileged root processes interact with directories or directory trees owned by unprivileged PCP users. Specifically, this vulnerability may lead to the compromise of PCP user isolation and facilitate local PCP-to-root exploits, particularly through symlink attacks. These vulnerabilities underscore the importance of maintaining robust privilege separation mechanisms within PCP to mitigate the potential for unauthorized privilege escalation.
  • CVE-2024-3019: (needs triaging) A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually. The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This flaw affects PCP versions 4.3.4 and newer.
  • CVE-2024-45769: (needs triaging) A vulnerability was found in Performance Co-Pilot (PCP).  This flaw allows an attacker to send specially crafted data to the system, which could cause the program to misbehave or crash.
  • CVE-2024-45770: (needs triaging) A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges.
Created: 2024-02-29 Last update: 2026-10-30 18:00
lintian reports 2 errors and 12 warnings high
Lintian reports 2 errors and 12 warnings about this package. You should make the package lintian clean getting rid of them.
Created: 2026-08-14 Last update: 2026-10-15 16:30
9 security issues in bullseye high

There are 9 open security issues in bullseye.

6 important issues:
  • CVE-2026-16524: A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.
  • CVE-2026-16526: A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.
  • CVE-2026-16527: An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.
  • CVE-2026-16529: A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.
  • CVE-2026-16530: A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.
  • CVE-2026-16531: An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.
2 issues postponed or untriaged:
  • CVE-2023-6917: (needs triaging) A vulnerability has been identified in the Performance Co-Pilot (PCP) package, stemming from the mixed privilege levels utilized by systemd services associated with PCP. While certain services operate within the confines of limited PCP user/group privileges, others are granted full root privileges. This disparity in privilege levels poses a risk when privileged root processes interact with directories or directory trees owned by unprivileged PCP users. Specifically, this vulnerability may lead to the compromise of PCP user isolation and facilitate local PCP-to-root exploits, particularly through symlink attacks. These vulnerabilities underscore the importance of maintaining robust privilege separation mechanisms within PCP to mitigate the potential for unauthorized privilege escalation.
  • CVE-2024-3019: (needs triaging) A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually. The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This flaw affects PCP versions 4.3.4 and newer.
1 ignored issue:
  • CVE-2024-45770: A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges.
Created: 2026-07-30 Last update: 2026-08-29 19:00
AppStream hints: 1 error and 1 warning for pcp-gui high
AppStream found metadata issues for packages:
  • pcp-gui: 1 error and 1 warning
You should get rid of them to provide more metadata about this software.
Created: 2018-06-04 Last update: 2026-02-23 04:00
Does not build reproducibly during testing normal
A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!
Created: 2026-11-01 Last update: 2026-11-10 20:33
version in VCS is newer than in repository, is it time to upload? normal
vcswatch reports that this package seems to have a new changelog entry (version 7.2.3-1, distribution unstable) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:
commit 596d3d90a161e4682b3a237f9d7486aeee44c785
Merge: 9a98a0b3 71473a80
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Nov 8 07:11:55 2026 +1100

    Merge pull request #2780 from kmcdonell/wip
    
    QA, small code refinements and fix for issue #2779

commit 71473a8096e8375d7480e5a4ee43fcf425fe7164
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sat Nov 7 16:44:29 2026 +1100

    qa/1339: changes suggested by @coderabbitai
    
    - quoting
    - saving and reporting stderr for failing commands

commit ca5978481cea2ca59a80617ecf57c950395fe3fa
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sat Nov 7 16:43:07 2026 +1100

    scripts/start: rework
    
    Drop the whole "where is the base of your gir tree" pile of steaming ...
    go back to only known and trusted places for pcp.conf and common.check.
    
    Clean up some other quoting and exit status issues.

commit 368f03d5b55c8bd956c7a87d17090391711c1392
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sat Nov 7 16:18:43 2026 +1100

    src/libpcp/src/derive_fetch.c: another (obscure) corner case with ternary op and novalue()
    
    In the context of PR #2780, @coderrabitai culled this one out of thin air:
        guard ? novalue(meta=metric) : metric
    and asserted this would SEGV.
    
    New qa/1965 (and the valgrind dual qa/1966) showed this assertion to be
    true.
    
    Fixed by some extra logic in eval_expr() to guard against the
    novalue(meta=metric) case where the expression N_NOVALUE node has a pmDesc
    and if the metric has an indom, then desc.indom is not PM_INDOM_NULL but
    this node in the expression tree will never have any instances ...  so
    force the instance enumeration onto the other operand node.

commit ef11e53e861785c6ab93a787cfb7250b073e143c
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sat Nov 7 16:17:28 2026 +1100

    src/libpcp/src/tz.c: tweak logic, comment on Solaris TODO for TZ= quoting
    
    Based on suggestions from @coderabbitai in the context of PR #2779.

commit 86a91990b2c438c187b9aebf910fda491ae2441c
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sat Nov 7 07:48:32 2026 +1100

    src/libpcp/src/derive_fetch.c: fix for ternary expr with novalue()
    
    Resolves https://github.com/performancecopilot/pcp/issues/2779
    
    Also new qa: 1738 and 1739

commit 066029a2cc760b8854eb70ece8a2f4ed50b30527
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sat Nov 7 07:34:25 2026 +1100

    man/man1/pcpintro.1: fix indentation for -s block

commit eb6f7c9484c93230922ddaf837660698ddf2c937
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Nov 6 06:56:34 2026 +1100

    src/libpcp/src/lock.c: change lock in SetupDebug()
    
    As reported in Coverity CID 505912 there was a lock inversion between
    pmflush() holding lock_util and then aquiring __pmLock_extcall via
    SetupDebug() which is called from __pmInitLocks() which is called
    from __pmProcessAddArg().
    
    Change the locking in SetupDebug() to use the existing local and
    low-level lock lock_lock.

commit b6b0368412996ac147f21fb5784aed0982fb1ec5
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Nov 6 06:36:28 2026 +1100

    src/python/pmapi.c: plug small memory leak
    
    in setOptionHost(), __pmAddOptHost() strdup's the host argument so
    free(host) needed on the success path.
    
    Fixes Coverity CID 506007

commit 079204264424c5ee9e91b0cdb9473b4d0508a696
Merge: d82fc5d6 9a98a0b3
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Nov 6 06:11:07 2026 +1100

    Merge branch 'main' of https://github.com/performancecopilot/pcp

commit d82fc5d6d88089518cc7b4e729d15ab836980023
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 22:00:18 2026 +1100

    src/libpcp/src/tz.c: Solaris change use /etc/default/init instead of /etc/TIMEZONE
    
    The latter is a symlink to the former.

commit 9a98a0b36c8f94382f0748d7b08c025e34f9f8c0
Merge: aacfff8c 876d72ff
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 21:53:03 2026 +1100

    Merge pull request #2777 from kmcdonell/main
    
    Post-Halloween Mystery Bag

commit 7a4ec15b73748785d749743e0e18541ba259f470
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 17:42:05 2026 +1100

    src/libpcp/src/tz.c: strip at first whitespace (not just \n) in __pmZoneinfo()
    
    In the Solaris case, when parsing a TZ= line from /etc/TIMEZONE.

commit 98043638619ca063fb8ddc99d27c7c90340b4f3d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 17:34:06 2026 +1100

    src/libpcp_pmda/src/pduroot.c: save errno before calling pmNotifyErr()
    
    In __pmdaRecvRootPDUStartReq() and __pmdaRecvRootPDUStart().

commit 86b640502a2f6682f6cd094b969eb4bb7813acf4
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 15:55:57 2026 +1100

    src/libpcp_pmda/src/open.c: use wide options to ps(1) in openBSD desperate diagnostic in __pmdaOpenSocket()

commit f34200bcd7d22f0d07cc9e91c355cf4b8a970fff
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 15:54:33 2026 +1100

    scripts/start: better logic to find pcp.conf and common.check

commit c121a8d1bc8be710b3c7c57483992b5e61ae7e9f
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 15:38:16 2026 +1100

    qa/admin/install-packages: handle Solaris version of pkg(1)
    
    install does not have a -y option.

commit a8c2282ac83f3406902d7ea1021d6a7d3b08bffb
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 15:37:27 2026 +1100

    qa/1339: guard against $PCP_RUN_DIR/pmcd.pid missing or empty

commit 876d72ffaa0bf1d41bd4a4a234f5c790625317af
Merge: 4fbd59d1 27f1a4bd
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 08:15:18 2026 +1100

    Merge branch 'main' of https://github.com/kmcdonell/pcp

commit 4fbd59d18cadcffd9d25780661b025ded7823c93
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 08:03:18 2026 +1100

    src/libpcp/src/util.c: extend buffer for "append pid" link name in logreopen()

commit 00795990cc09a1f9dd6624a201fbe483e06564eb
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 07:56:04 2026 +1100

    src/libpcp_pmda/src/open.c: report bind error before OpenBSD desperate diagnostics
    
    In __pmdaOpenSocket().  Spotted by @coderabbitai.

commit 70537b94303aa1c90c81b7ba785ef5af61935528
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 07:51:06 2026 +1100

    qa/admin/post-setup: assorted Solaris fixups
    
    Mostly networking ... separate static IP addr setup from default route
    setup.

commit 377d370a23020231f1ae84f9a04f07dc1aa7a40d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 07:32:56 2026 +1100

    qa/admin/post-setup: rearrange some code blocks
    
    Make sure platform and packaging variables are set before
    they are used.

commit 3521fb6c5b0d66ff6da6f899a7c83927ded39398
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 07:20:01 2026 +1100

    qa/603: revert No route mapping from last commit
    
    Taking @coderabbitai's suggestion here.  After PR #2777 is done
    I'll cycle back and re-investigate this one failing on OpenSolaris
    (vm29).

commit 9447daeba4e30f0c0481506d1c0c10c56d81ab0d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 07:17:08 2026 +1100

    qa/admin/post-setup: rework logic for serial console login on Solaris
    
    Needed to seperate setting up the console-login:terma svc from
    enabling the same svc.

commit 30bb5cde78cee193eb292d71503a3998f7d23d03
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 06:24:45 2026 +1100

    src/libpcp/src/util.c: logreopen() tweaks
    
    - guard against strdup() failing in OpenBSD desperate diagnostic block
    - improve locking for one-trip initialization of append_pid

commit d69ff6f7a35d7105b2fe657e7dd5fd7d4a3e1e22
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 06:20:14 2026 +1100

    src/pmieconf/rules.c: fix free-then-return in read_all_rules()
    
    Not return-then-free!

commit 4adb47ba43f49ce29ba4e3541655ae0d0e7bb5ca
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 06:12:30 2026 +1100

    src/libpcp/src/tz.c: fclose for /etc/TIMEZONE in __pmZoneinfo before return

commit 3a230934802e8aaf61dee81bf8318756ceb12c6a
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 06:10:05 2026 +1100

    src/libpcp_pmda/src/pduroot.c: fix diagnostics in __pmdaRecvRootPDUStartReq()
    
    Message prefix should be __pmdaRecvRootPDUStartReq not __pmdaSendRootPDUStartReq
    (cut-n-paste error).

commit 27f1a4bdc4ecb7bd44edfa7af0cc4cbd807c64c7
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 21:37:05 2026 +1100

    Update src/libpcp/src/util.c
    
    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

commit ffbdba0b0346aaaf7d504749fc16d3ce01766c3d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 21:34:08 2026 +1100

    Update man/man1/pcpintro.1
    
    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

commit e4e0def96d17dca05751bd7a357cccdd1c370073
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 21:29:36 2026 +1100

    qa/1339: use $PCP_RUN_DIR instead of /var/run/pcp

commit 5a00f1b9beeabb0596a2f8f1583bbe3ff25579c7
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 21:24:31 2026 +1100

    qa/admin/post-setup: reinstate check for duplicate connections from nmcli(1)

commit 1b9c19ed39d0f62c65ffe9c3f5937176bc84f664
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 17:09:58 2026 +1100

    scripts/start: also need _systemctl_status() from qa/common.check

commit d677765502c2fd89f25fc86e0f82a0270466858e
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 16:55:53 2026 +1100

    scripts/start: set $sts on success before exit

commit fa2b4b11be2b2ed22f641f8e396ae86ce4e84887
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 16:51:52 2026 +1100

    scripts.start et al: several changes
    
    Change from hard links to symlinks (the former are lost by git).
    Ensure probe for systemctl from qa/common.check that is outside
    _service() is included here.

commit f35b12461f9103537b135fa26097986c01a03a30
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 16:30:22 2026 +1100

    Update src/libpcp_pmda/src/root.c
    
    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

commit 2752574546c6940d9bdc04507ae1775d9bf0ab3b
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 16:18:53 2026 +1100

    Update man/man1/pcpintro.1
    
    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

commit 77fa89d33775803192bf5bf04e859ccc4aa0c9e0
Merge: 2dd5b239 aacfff8c
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 14:55:03 2026 +1100

    Merge branch 'main' of https://github.com/performancecopilot/pcp

commit 2dd5b2391f4e1277c3748bc8b603198ccaeccdf0
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 14:42:49 2026 +1100

    qa/603: refactor for OpenIndiana (vm29)
    
    Several oddities surfaced on this platform.  Refactor works here and on Linux.

commit 180e6bc04e6b6e5e2facb781ba27402eb2d3efcf
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 14:41:57 2026 +1100

    qa/common.check: remove a remaining $seq.full ...
    
    Should be $seq_full, always.

commit 6abcf50112c80abf846a365cc8082c9dec32e1d8
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 14:40:51 2026 +1100

    qa/510: additional diagnostics to 510.full

commit ff54cd20c6f13c7f91966d5dd673a9cfc4fd9e7b
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 14:40:02 2026 +1100

    qa/590: the C compiler is not necessarily cc
    
    Use $PCP_CC_PROG instead.
    
    Broke on OpenIndiana (vm29).

commit a4595c4aad193325cf5321a0dbb0243e6fcb02b3
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 14:38:14 2026 +1100

    qa/063 and qa/069: the C compiler is not necessarily cc
    
    Use $PCP_CC_PROG instead.
    
    Broke on OpenIndiana (vm29).

commit e1edcfbe3931f04c054d6dfd52f787a6e0af0ea3
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 14:20:31 2026 +1100

    src/libpcp/src/tz.c: add zoneinfo method for Solaris-style
    
    Timezone is hidden in /etc/TIMEZONE on these platforms, on a TZ=Foo/Bar
    line.
    
    Fixes the pmcd.zoneinfo metric value and a handful of QA failures on
    OpenIndiana (vm29).

commit 297c60be11879a17c6af0d0ad67891de34a79be9
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 14:16:51 2026 +1100

    scripts: add convenience shell wrappers for QA _service() function
    
    This itch has only been there for 30 years.
    
    Intended for developers ... so for example,
        $ restart pmcd
    works on EVERY platform.
    
    start, stop, restart and status are all hard links to the same
    script.

commit aacfff8cc9c41da0ead787ee3ca780a0cb9adf32
Author: William Cohen <wcohen@redhat.com>
Date:   Mon Nov 2 15:48:12 2026 -0500

    qa: Properly free allocated memory in interp_bug3.c
    
    Observed test 1583 failing due to memory leaks in interp_bug3.c:
    
    [82%] 1583 - output mismatch (see 1583.out.bad)
    5a6,15
    > 160 bytes in 1 blocks are definitely lost in loss record 60 of 72
    > at 0x486C826: malloc (vg_replace_malloc.c:447)
    > by 0x4002787: main (interp_bug3.c:199)
    > {
    >    <insert_a_suppression_name_here>
    >    Memcheck:Leak
    >    match-leak-kinds: definite
    >    fun:malloc
    >    fun:main
    > }
    7c17
    < definitely lost: 0 bytes in 0 blocks
    ---
    > definitely lost: 160 bytes in 1 blocks
    9c19
    < ERROR SUMMARY: 0 errors from 0 contexts ...
    ---
    > ERROR SUMMARY: 1 errors from 1 contexts ...
    Check local PMCD is still alive ...
    
    Added a matching call to free the memory allocated in main just before
    it is exited to eliminate the memory leak reported by valgrind.

commit 4eb252f44a9054ebf5aba1f30d877a4c75791ca6
Merge: d6de16a4 407329f9
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Nov 3 12:03:30 2026 +1100

    Merge branch 'main' of https://github.com/performancecopilot/pcp

commit d6de16a4f24e62f52587d08e181fa6fa4244da28
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Nov 3 12:01:54 2026 +1100

    qa/1429: tweak filter
    
    Had potential filter snarfoo when run on the first 3 days of any month.
    
    Don't ask.

commit 5b8c0dd03c8200825ce0ca6b2b1b290b636ec055
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Nov 3 12:01:20 2026 +1100

    qa/1339: additional diagnostics for the socket+root-PMDA saga

commit 0ef1d4c70d1fa5fc1b3a8ef52a614935468013ac
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Nov 3 11:59:52 2026 +1100

    src/libpcp_pmda/src/root.c: more on the socket+root-PMDA saga
    
    Added additional diagostics (with -Dlibpmda guard) to report (previously
    silent) failures in:
        pmdaRootProcessStart()

commit 56494422bd816b26f99deecca12a2582c0a98cf3
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Nov 3 11:50:33 2026 +1100

    src/libpcp_pmda/src/pduroot.c: more on the socket+root-PMDA saga
    
    Added additional diagostics (with -Dlibpmda guard) to report (previously
    silent) failures in:
        __pmdaSendRootPDUStartReq()
        __pmdaRecvRootPDUStartReq()
        __pmdaRootPDUStart()
    
    And the *critical* fix in __pmdaSendRootPDUStart() to not use msg_control
    when either infd < 0 or outfd < 0 ... *not* doing this led to a malformed
    struct msghdr being passed to sendmsg() which on OpenBSD (vm29) caused the
    hand-off from pmcd to the root PMDA to fail for the sample PMDA, and the
    fallback left the sample PMDA as a child of pmcd, not the root PMDA, so
    the sample PMDA was not killed off and the second attempt to install it
    with -i 54321 failed because the old sample PMDA was still using the port.
    
    All other platforms apparently have less-picky checking below sendmsg() so
    this issue had been undetected since it was introduced in Dec 2014!!

commit 882dd8894c19a43bdfffcc28679580aaf292ebb8
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Nov 3 11:47:29 2026 +1100

    src/libpcp_pmda/src/open.c: additional OpenBSD-only diagnostics
    
    More of the socket+root-PMDA, this time chasing why binding to port 54321
    for the sample PMDA with -i fails in qa/1339 but only after qa/283 is run.
    
    Turns out this was only a symptom ... the root cause lies with the root
    (excuse the pun) PMDA ... more commits coming on this front.

commit f4ad3552914a051d5303e9f0004bd3a07b0dfbfc
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Nov 3 08:55:36 2026 +1100

    src/pmcd/pmcd.defaults: expose $PCP_LOGS_APPEND_PID handle
    
    Commented out (of course).

commit bdc1da50e86dfdebe1d62b26cfa7cec8e6878543
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Nov 3 08:52:01 2026 +1100

    src/pmcd/src/config.c: additional -Dappl6 diagnostics
    
    Calls to a number of routines had no diagnostics on their failure
    paths, specifically calls to:
            pmdaRootConnect()
            pmdaRootProcessStart()
            CreateRootAgentPOSIX()
    
    And a couple of diagnostics had the wrong (appl4) guard.
    
    All on the path to tracking down the socket+root-PMDA problem
    on OpenBSD.

commit 9ff89e6ccef37dfbf6311354d10531f54497b95e
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Nov 3 08:50:21 2026 +1100

    src/pmcd/src/dofetch.c: fix compiler warning on OpenBSD

commit d37046f8ae10038a92ce46ab0e4a0db83a32abf1
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Nov 3 08:14:51 2026 +1100

    libpcp: add $PCP_LOGS_APPEND_PID - append <pid> to linked file for pmOpenLog
    
    In chasing a socket and pmda root problem on OpenBSD (vm27) I needed the
    complete history of pmcd and pmda log files ... the *.log and *.log.prev
    scheme is not detailed enough if these files churn frequently in a single
    QA test.
    
    When this environment variable is set, every fopen() in pmOpenLog()
    also creates a hard link using the same file name with a <pid> appended
    the links persist for ever and so provide a complete history for triage.
    
    The code change is confined to pmOpenLog() in src/libpcp/src/util.c but
    spilled out into check-statics (for the one-trip guard for the getenv())
    and the man pages.
    
    There is also some re-organization of the order of environment variable
    entries in the pcpintro.1 man page that was picked up in passing.

commit 407329f90725c7542d9eff40424e13f4080941d1
Author: Nathan Scott <nathans@redhat.com>
Date:   Sat Oct 31 13:48:20 2026 +1100

    build/ci: handle redis/valkey conflict on newer Ubuntu runners
    
    Newer Ubuntu releases (24.04+, and now ubuntu-latest 26.04) can install
    both redis-server and valkey-server.  Both default to port 6379, so only
    whichever package starts first during apt-get install is actually running;
    the other one fails to start.
    
    Previously redis-server invariably won that race, so the explicit
    'systemctl start redis' worked.  On the Ubuntu 26.04 runner image valkey
    starts first, so the redis-server unit is left failed and the QA init
    step aborts the job before any tests run.
    
    Start valkey first and fall back to redis, matching the preference QA
    already uses when both are installed.
    
    Signed-off-by: Nathan Scott <nathans@redhat.com>

commit 00c0fb2f49e9eedde624f5270ee449523cd7127d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sat Oct 31 07:45:39 2026 +1100

    qa/admin scripts: rework after OpenIndiana forced re-install on vm29
    
    Lots of things missing from post-setup because the VM setup on vm29
    was previously done by hand and pre-dated post-setup.
    
    Small tweaks and extensions to check-vm.

commit 5aa3a2d5c45567862fbf2cc765b7137ce2ffe135
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Oct 27 07:27:28 2026 +1100

    libpcp, libpcp3 and libpcp_pmda: improve cast for __pmSetSockOpt arg
    
    int one; ..., (char *)&one is misleading, it should be (void *)&one
    
    This is not the cause of the qa/1339 failure on vm27 (amd64 OpenBSD 7.8)
    with this signature:
        __pmdaOpenSocket(,54321,2): bind: Address already in use
    but with these changes in place grind 1339 ran for 14 hours without
    failing ... but when I ran it again *after* qa 283 the failure
    seems solid.
    
    Added diagnostics on the failure path pro tem to try and debug this.

commit 1846e834b1e909b404b3d253bce57ca1f70045e7
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Oct 26 16:24:33 2026 +1100

    qa/admin/pcp-daily: fix botched Solaris package install line
    
    Was pkgadd'ing pcp twice which royally screwed with pmcd.conf.

commit 82cf4cf6e9db7216854a6cfb0c7676ea79733b44
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Oct 26 14:46:32 2026 +1100

    Revert "qa/1339: _notrun on OpenBSD"
    
    This reverts commit 10e33da997c549467f30990a3e2d550d9b19b2cb.
    
    Triaging the root causes on OpenBSD some more.

commit 10e33da997c549467f30990a3e2d550d9b19b2cb
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Oct 25 07:00:37 2026 +1100

    qa/1339: _notrun on OpenBSD
    
    This one has been lurking forever ... there is something about the probing
    and use of a TCP/IP port here that fails 100% of the time on (apparently
    all versions of) OpenBSD with this in pmcd's log
    
    pmdasample(96990) Critical: __pmdaOpenSocket(,54321,2): bind: Address already in use
    
    Since the test passes everywhere else, skip it on OpenBSD.

commit 71a50cf5c8e7d918ce01969403a325637bc2b6de
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sat Oct 24 18:44:23 2026 +1100

    src/pmieconf/rules.c: clean up memory leaks on error paths
    
    Probably never seen, because errors => exit for pmieconf, but
    Coverity noticed and CIDs 454664 and 454667 have been lurking
    for a long time.
    
    (new) qa/1736 and the valgriand dual qa/1737 exercise the
    error paths in question.

commit 791edf838b2ea39b18952cc0212b0d236489570a
Merge: c42b90f5 fe4b6e81
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Oct 23 09:26:58 2026 +1100

    Merge pull request #2772 from kmcdonell/wip
    
    Refactor _get_primary_logger_pid()

commit fe4b6e8161efd70466ba8205e964272f7828bca1
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Oct 23 07:07:49 2026 +1100

    qa fixups after _get_primary_logger_pid() changes
    
    - update qa/COOKBOOK.md description
    - tweak filter for qa/1429

commit 941c5ae636e9cb009be5ca308aa24fb3d3c0c39a
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Oct 22 21:48:00 2026 +1100

    pmlogger scripts: refactor _get_primary_logger_pid()
    
    - add single implementation that is more robust in utilproc.sh
    - remove _get_primary_logger_pid() from pmlogger_check.sh,
      pmlogger_daily.sh and pmlogger_janitor.sh
    - replicate the single implementation in qa/common.check (where we
      cannot easily get the utilproc.sh one)
    - new qa/1734 to exercise this on all error paths

commit c42b90f5413f93b0365f473bd5d97d7ad6bf5e5a
Merge: 43780fa6 4831e68b
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 21 17:51:22 2026 +1100

    Merge pull request #2770 from kmcdonell/wip
    
    macOS fixups

commit 4831e68b9ceda71c77085b58a6f74dbbc46fd4a1
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 21 16:50:22 2026 +1100

    improvements from @coderabbitai
    
    In the context of PR #2770.

commit a7f94a677fb549b06ed9c770b4a4075d3b58492e
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 21 11:54:32 2026 +1100

    admin/pcp-daily: dodge stderr from virsh
    
    ... when it is installed, but not configured ... nothing to report,
    nothing to see.

commit 10c33932c5e24b0f3b77a38ce11272c9c6528a33
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 21 11:49:07 2026 +1100

    qa/admin/package-lists/Darwin+27+arm64: new package list
    
    And some script updates for Darwin 27 (aka macOS Golden Gate).

commit 73aed9f404d8759b6e5c3d1b5319a38e4cf5cd43
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 21 07:48:17 2026 +1100

    qa/admin/package-lists/Darwin+25+arm64: package list updates
    
    and manifest update to include bison from Homebrew, not macOS
    base install.

commit dff18450beb3e046747f054e832abf2aa6d41ece
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 21 07:26:13 2026 +1100

    src/pmlogger/utilproc.sh: revert introduction of __realpath() function
    
    This was just a bad idea and is causing pmlogger_check to fail
    on at least macOS, see
    https://github.com/performancecopilot/pcp/issues/2769
    
    We use realpath(1) elsewhere in the build and QA so we should
    just use that in utilproc.sh.
    
    This commit reverts and replaces commit 01ed7a4fe.

commit 869cc4055f3edbb70e63f5d31476ac816cffde1e
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Oct 20 10:41:13 2026 +1100

    qa/admin/pcp-daily: add -f for poweroff on some VMs
    
    vm08 (CentOS 7) was hanging at shutdown without this.

commit d05820a9c8b98ee92c2f720b7587294feb5d1e4c
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Oct 20 10:40:34 2026 +1100

    qa/admin/package-lists/NetBSD+10.1+i386: package list update

commit 43780fa6dc59cc035328d0b3418cc6fb16a99d59
Merge: 41af059d 55e37cce
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Oct 19 08:08:38 2026 +1100

    Merge pull request #2767 from kmcdonell/wip
    
    fix macOS build

commit 55e37ccedf36a37415e3d784c54dafc49dc18c41
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Oct 19 07:14:39 2026 +1100

    qa/admin/pcp-daily: change from $PCP_ECHO_PROG to printf(1)

commit 1d9c744cd7592d06aad0566413259599c0dcad10
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Oct 19 07:12:50 2026 +1100

    configure.ac: make sure $yacc_prog is a full pathname ...
    
    Even in the unlikely event that we're not using bison.

commit 2d5092117906fd9ec40901179edafef2ec9f526d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Oct 19 07:11:57 2026 +1100

    src/pmcd/rc_pmcd: guard against startup race for pmda.auto.update lock file

commit 9c16142ce9cacd1a6587b744e2192a1585d0aff3
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Oct 18 16:26:32 2026 +1100

    macOS build: add bison to Brewfile and tweak Darwin 25 package list

commit aaae48a8e32a3acc2cf3b2ef2687f12d79690ac2
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Oct 18 16:05:02 2026 +1100

    macOS build: recent libpcp changes mean we need homebrew bison
    
    The old and mouldy bison that ships with macOS won't cut the mustard for
    the %destructor pragmas recently added to derive_parser.y.in in libpcp.
    
    But we need to dodge the macOS installed one and dig out the homebrew one
    that is a keg-only install and so the executable is hidden in a secret bin
    directory that configure.ac needs to know how to find.

commit 38c187af4ecd0ea624f9567bc3ecb02589d83a7d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Oct 18 16:01:20 2026 +1100

    src/pmcd/rc_pmcd: remove stale pmda.auto.update lock file
    
    Seen on macOS ... and once it is there, all subsequent PMDA
    Install or Remove operations fail.

commit a27f513577a2d601fdc280fc98a5e54f6f40676c
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Oct 18 15:59:20 2026 +1100

    qa/admin/pcp-daily: replace echo -n (for macOS)

commit 41af059d081bfa05c6d27490f61739a977cd2246
Merge: 3751a9d1 a671496d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Oct 18 08:00:28 2026 +1100

    Merge pull request #2766 from kmcdonell/wip
    
    QA and small changes for linux PMDA and pmlogger management scripts

commit a671496d55a30b2e844a928afaaeebbf4aca2ebe
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Oct 18 06:55:51 2026 +1100

    src/pmdas/linux/add_netstat_field: add exit status logic
    
    1 (default) for all errors, 0 for success

commit 2a2cee3ab059a2a98f03da2a6d3e2e0e65b0ddb5
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Oct 18 06:53:41 2026 +1100

    qa/admin/qa-summary: fix mac, mac-fed and mac-deb abbreviations and heading fields

commit 01ed7a4fe3884925b1ab47255a72ef4981d7ed82
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sat Oct 17 16:49:19 2026 +1100

    misc: improvements suggested by coderabbitai in the context of PR #2766

commit 627234718ab153d7b6ceb24fe91e7f455a367af5
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Oct 16 08:41:11 2026 +1100

    Update src/pmlogger/utilproc.sh
    
    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

commit 486ee6e2f21a5529608c7eeffc4633a22fc52a1f
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Oct 16 07:39:00 2026 +1100

    qa/2113: filter away differences in regexp error message text
    
    Problem seen on vm33 (OpenBSD 7.9).

commit cc5b974d5641fc0e22536aff3c85b2e38ea33c58
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Oct 16 07:06:49 2026 +1100

    linux PMDA: add a bunch of new MPTcpExt fields for networking metrics
    
    Seen on vm12 (Fedora Rawhide).

commit faf7933f6afdad50ee49475ff33e1ac831f928c3
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Oct 16 07:06:12 2026 +1100

    src/pmdas/linux/add_netstat_field: extension to allow > 1 field on command line

commit 4939166b1891c43d4044fcab92029ab9544dc83c
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Oct 16 07:04:46 2026 +1100

    qa/2110: need $sudo with pminfo -L
    
    Else cannot access dev mapper control file.
    
    Seen on vm12 (Fedora Rawhide).

commit 3323ba2a3898d8592d806b4f733735c652e1a94d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Oct 16 06:05:47 2026 +1100

    qa: package list and small qa test changes for MX Linux 25.3

commit 3cf1c733708694fc77da85cd22ac3d78991b1bfa
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Oct 16 06:05:09 2026 +1100

    ci-qa/update: keep tmp.* files for debugging with -d

commit 65a4a444c71fdc794c90bcbeb22fff32b43eebe0
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Oct 15 22:07:00 2026 +1100

    qa/1429: tweak filter

commit 7e437565915c07053a583a8cf4926d541b853598
Merge: 58c3eef1 3751a9d1
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Oct 15 08:41:33 2026 +1100

    Merge branch 'main' of https://github.com/performancecopilot/pcp

commit 58c3eef1b9c979b183d048b219af67ae41f0477b
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Oct 15 08:37:10 2026 +1100

    qa/1187: refactor to dodge stty hanging issue
    
    On some platforms (notably bozo when running check from an interactive
    shell), qa/1187 was hanging in stty(1).
    
    - split the stty-part out from qa/1187 into the (new) qa/1733
    - refactor some of the qa/1733 logic and reduce output chatter
    - in qa/1733 add _notrun if stdout is not a tty (this seems to be the
      trigger for the hang scenario)

commit bc4e4bc1fc13bb232bf1c3b52f57866f54f50193
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Oct 15 08:35:45 2026 +1100

    qa/common.qt: add another Qt warning to filter_qt()

commit 3751a9d148d5b83af6e9d51a3b889ecb67772a13
Author: lmchilton <lauren.chilton26@gmail.com>
Date:   Tue Oct 13 13:53:56 2026 -0400

    Resolves: RHEL-130497 fix for too strict parsing, specifically handling empty scope in json object

commit f2ed83d0d0488d5590637a41f90a1ea551932c06
Merge: f2559055 5ef01f17
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 14 14:58:02 2026 +1100

    Merge branch 'main' of https://github.com/performancecopilot/pcp
Created: 2026-05-23 Last update: 2026-11-10 04:17
Multiarch hinter reports 1 issue(s) low
There are issues with the multiarch metadata for this package.
  • pcp-doc could be marked Multi-Arch: foreign
Created: 2016-09-14 Last update: 2026-11-10 17:48
6 low-priority security issues in trixie low

There are 6 open security issues in trixie.

6 issues left for the package maintainer to handle:
  • CVE-2026-16524: (needs triaging) A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.
  • CVE-2026-16526: (needs triaging) A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.
  • CVE-2026-16527: (needs triaging) An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.
  • CVE-2026-16529: (needs triaging) A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.
  • CVE-2026-16530: (needs triaging) A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.
  • CVE-2026-16531: (needs triaging) An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-07-30 Last update: 2026-10-30 18:00
Standards version of the package is outdated. wishlist
The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).
Created: 2025-12-23 Last update: 2026-10-07 09:20
testing migrations
  • This package will soon be part of the perl-5.44 transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
  • This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
news
[rss feed]
  • [2026-10-31] pcp 7.2.2-1 MIGRATED to testing (Debian testing watch)
  • [2026-10-07] Accepted pcp 7.2.2-1 (source) into unstable (Nathan Scott)
  • [2026-08-30] pcp REMOVED from testing (Debian testing watch)
  • [2026-08-16] pcp 7.2.1-2 MIGRATED to testing (Debian testing watch)
  • [2026-08-14] Accepted pcp 7.2.1-2 (source) into unstable (Nathan Scott)
  • [2026-08-01] pcp 7.2.0-1 MIGRATED to testing (Debian testing watch)
  • [2026-07-30] Accepted pcp 7.2.0-1 (source arm64 all) into unstable (Debian FTP Masters) (signed by: Nathan Scott)
  • [2026-05-29] pcp 7.1.5-1 MIGRATED to testing (Debian testing watch)
  • [2026-05-26] Accepted pcp 7.1.5-1 (source) into unstable (Nathan Scott)
  • [2026-05-25] pcp 7.1.4-1 MIGRATED to testing (Debian testing watch)
  • [2026-05-22] Accepted pcp 7.1.4-1 (source) into unstable (Nathan Scott)
  • [2026-05-02] Accepted pcp 7.1.3-2 (source) into unstable (Nathan Scott)
  • [2026-04-27] pcp 7.1.2-1 MIGRATED to testing (Debian testing watch)
  • [2026-04-24] Accepted pcp 7.1.2-1 (source) into unstable (Nathan Scott)
  • [2026-04-02] pcp 7.1.1-1 MIGRATED to testing (Debian testing watch)
  • [2026-03-30] Accepted pcp 7.1.1-1 (source) into unstable (Nathan Scott)
  • [2026-01-30] pcp 7.1.0-1 MIGRATED to testing (Debian testing watch)
  • [2026-01-28] Accepted pcp 7.1.0-1 (source) into unstable (Nathan Scott)
  • [2025-12-05] pcp 7.0.5-1 MIGRATED to testing (Debian testing watch)
  • [2025-11-21] Accepted pcp 7.0.5-1 (source) into unstable (Nathan Scott)
  • [2025-11-19] Accepted pcp 7.0.4-1 (source) into unstable (Nathan Scott)
  • [2025-11-12] Accepted pcp 7.0.3-1 (source arm64 all) into unstable (Nathan Scott)
  • [2025-11-01] pcp REMOVED from testing (Debian testing watch)
  • [2025-10-16] Accepted pcp 7.0.2-1 (source arm64 all) into unstable (Debian FTP Masters) (signed by: Nathan Scott)
  • [2025-09-23] Accepted pcp 7.0.1-1 (source arm64 all) into unstable (Debian FTP Masters) (signed by: Nathan Scott)
  • [2025-09-01] Accepted pcp 7.0.0-1 (source arm64 all) into unstable (Debian FTP Masters) (signed by: Nathan Scott)
  • [2025-04-21] pcp 6.3.8-1 MIGRATED to testing (Debian testing watch)
  • [2025-04-11] Accepted pcp 6.3.8-1 (source) into unstable (Nathan Scott)
  • [2025-04-07] pcp 6.3.7-1 MIGRATED to testing (Debian testing watch)
  • [2025-03-28] Accepted pcp 6.3.7-1 (source) into unstable (Nathan Scott)
  • 1
  • 2
bugs [bug history graph]
  • all: 5
  • RC: 0
  • I&N: 5
  • M&W: 0
  • F&P: 0
  • patch: 0
links
  • homepage
  • lintian (2, 12)
  • buildd: logs, reproducibility, cross
  • popcon
  • browse source code
  • other distros
  • security tracker
  • screenshots
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 7.2.1-2build1
  • 2 bugs

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing