CVE-2024-47619: tranport: TLS host name wildcard matching too lax
First published: Wed May 07 2025(Updated: )
syslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo.*.bar` although that is not allowed. It is also possible to pass partial wildcards such as `foo.a*c.bar` which glib matches but should be avoided / invalidated. This issue could have an impact on TLS connections, such as in man-in-the-middle situations. Version 4.8.2 contains a fix for the issue.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| syslog-ng | <4.8.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-xr54-gx74-fghg
- https://github.com/syslog-ng/syslog-ng/commit/dadfdbecde5bfe710b0a6ee5699f96926b3f9006
- https://github.com/syslog-ng/syslog-ng/blob/b0ccc8952d333fbc2d97e51fddc0b569a15e7a7d/lib/transport/tls-verifier.c#L78-L110
- https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.8.2
Frequently Asked Questions
What is the severity of CVE-2024-47619?
CVE-2024-47619 is classified as a moderate severity vulnerability.
How do I fix CVE-2024-47619?
To fix CVE-2024-47619, upgrade syslog-ng to version 4.8.2 or later.
What type of systems are affected by CVE-2024-47619?
CVE-2024-47619 affects all versions of syslog-ng prior to 4.8.2.
What is the nature of the vulnerability in CVE-2024-47619?
CVE-2024-47619 allows incorrect wildcard matching on certificates, leading to potential validation issues.
Is there a workaround for CVE-2024-47619 if I cannot upgrade?
Currently, there are no established workarounds for CVE-2024-47619, and upgrading is recommended.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/source
- agent/severity
- agent/tags
- agent/event
- vendor/syslog-ng
- canonical/syslog-ng