CVE-2022-24903: Buffer overflow in TCP syslog server (receiver) components in rsyslog

Reference Links

• https://www.cve.org/CVERecord?id=CVE-2022-24903 https://nvd.nist.gov/vuln/detail/CVE-2022-24903 https://github.com/rsyslog/rsyslog/security/advisories/GHSA-ggw7-xr6h-mmr8
• https://bugzilla.redhat.com/show_bug.cgi?id=2081353
• https://access.redhat.com/errata/RHSA-2022:4808
• https://access.redhat.com/errata/RHSA-2022:4803
• https://access.redhat.com/errata/RHSA-2022:4799
• https://access.redhat.com/errata/RHSA-2022:4801
• https://access.redhat.com/errata/RHSA-2022:4800
• https://access.redhat.com/errata/RHSA-2022:4802
• https://access.redhat.com/errata/RHSA-2022:4795
• https://access.redhat.com/errata/RHSA-2022:5439
• https://access.redhat.com/errata/RHSA-2022:4896
• https://access.redhat.com/security/cve/cve-2022-24903
• https://security-tracker.debian.org/tracker/CVE-2022-24903
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24903
• https://github.com/rsyslog/rsyslog/security/advisories/GHSA-ggw7-xr6h-mmr8#advisory-comment-72243
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1010619
• https://www.openwall.com/lists/oss-security/2022/05/05/3
• https://github.com/rsyslog/rsyslog/commit/89955b0bcb1ff105e1374aad7e0e993faa6a038f
• https://github.com/rsyslog/rsyslog/commit/0381a0de64a5a048c3d48b79055bd9848d0c7fc2
• https://github.com/rsyslog/rsyslog/commit/01feb44bf1d091ec45ff425a096a0169f290da4b
• https://github.com/rsyslog/rsyslog/commit/6102f6083cfa73fe4a91e3d34c4d1dc924465278
• https://exchange.xforce.ibmcloud.com/vulnerabilities/225843
• https://www.ibm.com/support/pages/node/7007815 (Advisory)
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2082302
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2081091
• https://github.com/rsyslog/rsyslog/commit/f211042ecbb472f9d8beb4678a65d272b6f07705
• https://github.com/rsyslog/rsyslog/security/advisories/GHSA-ggw7-xr6h-mmr8
• https://lists.debian.org/debian-lts-announce/2022/05/msg00028.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMNNXLCU2UORRVSZO24HL4KMVPK5PHVW/
• https://security.netapp.com/advisory/ntap-20221111-0002/
• https://www.debian.org/security/2022/dsa-5150
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GMNNXLCU2UORRVSZO24HL4KMVPK5PHVW/

Parent vulnerabilities

(Appears in the following advisories)

• RHSA-2022:4808
• RHSA-2022:4803
• RHSA-2022:4799
• RHSA-2022:4801
• RHSA-2022:4800
• RHSA-2022:4802
• RHSA-2022:4795
• RHSA-2022:5439
• RHSA-2022:4896
• IBM-7007815

Frequently Asked Questions

• What is CVE-2022-24903?

  CVE-2022-24903 is a vulnerability in rsyslog that allows for a heap-based buffer overflow due to improper bounds checking by the TCP syslog reception module.

• What is the severity of CVE-2022-24903?

  CVE-2022-24903 has a severity value of 8.1, which is considered high.

• Which software versions are affected by CVE-2022-24903?

  The affected software versions include rsyslog 8.2204.1, rsyslog 5.8.10-12.el6_10.1, rsyslog7 7.4.10-7.el6_10.1, rsyslog 8.24.0-57.el7_9.3, rsyslog 8.2102.0-7.el8_6.1, rsyslog 8.37.0-13.el8_1.1, rsyslog 8.1911.0-3.el8_2.1, rsyslog 8.1911.0-7.el8_4.3, rsyslog 8.2102.0-101.el9_0.1, and redhat-virtualization-host 4.3.23-20220622.0.el7_9.

• How can I fix CVE-2022-24903?

  To fix CVE-2022-24903, users should update rsyslog to version 8.2204.1 or take the recommended remedies provided by the software vendor.

• Where can I find more information about CVE-2022-24903?

  More information about CVE-2022-24903 can be found on the CVE website (https://www.cve.org/CVERecord?id=CVE-2022-24903), NIST NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-24903), the rsyslog GitHub security advisories (https://github.com/rsyslog/rsyslog/security/advisories/GHSA-ggw7-xr6h-mmr8), and Red Hat Bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=2081353) and Errata (https://access.redhat.com/errata/RHSA-2022:4808).