DSA-5150: -1 rsyslog -- security update
Published May 28, 2022
·Updated
Peter Agten discovered that several modules for TCP syslog reception in rsyslog, a system and kernel logging daemon, have buffer overflow flaws when octet-counted framing is used, which could result in denial of service or potentially the execution of arbitrary code.
Affected Software
2 affected components
debian/rsyslog
debian/rsyslog
Event History
May 28, 2022
Advisory Published
12:00 AM
Frequently Asked Questions
1
Which deployments are exposed to this issue?
Deployments using rsyslog modules for TCP syslog reception are affected when they use octet-counted framing. The issue is in several TCP reception modules rather than being described as affecting all rsyslog configurations.
2
What must an attacker be able to do to exploit the flaw?
An attacker would need to send crafted syslog data to an affected rsyslog TCP receiver using octet-counted framing. Successful exploitation could cause a denial of service and may potentially allow arbitrary code execution.