contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is
    mishandled. (CVE-2019-17040)

  - An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap
    overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this
    case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the
    string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check
    that detects invalid log messages. The message will then be considered valid, and the parser will eat up
    the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was
    zero and now becomes minus one. The following step in the parser is to shift left the contents of the
    message. To do this, it will call memmove with the right pointers to the target and destination strings,
    but the lenMsg will now be interpreted as a huge value, causing a heap overflow. (CVE-2019-17041)

  - An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in
    the parser for Cisco log messages. The parser tries to locate a log message delimiter (in this case, a
    space or a colon), but fails to account for strings that do not satisfy this constraint. If the string
    does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that
    detects invalid log messages. The message will then be considered valid, and the parser will eat up the
    nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero
    and now becomes minus one. The following step in the parser is to shift left the contents of the message.
    To do this, it will call memmove with the right pointers to the target and destination strings, but the
    lenMsg will now be interpreted as a huge value, causing a heap overflow. (CVE-2019-17042)

rebase to upstream version 8.1911.0

------------------------------------------------- new modules available :

  - ClickHouse output

  - generic REST API http output

  - docker API input

  - misc. external program input (takes output of specified     binary as log source)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the rsyslog package has been released.

ID	Name	Product	Family	Type	Severity
424415	Alpine: multiple rsyslog packages: security update to 8.1908.0-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
424415	Alpine: multiple rsyslog packages: security update to 8.1908.0-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
131251	Fedora 30 : rsyslog (2019-1fb95ae48d)	Nessus	Fedora Local Security Checks	Local	critical
131206	Fedora 31 : rsyslog (2019-ea7d5876a4)	Nessus	Fedora Local Security Checks	Local	critical
130121	Photon OS 3.0: Rsyslog PHSA-2019-3.0-0034	Nessus	PhotonOS Local Security Checks	Local	critical
130116	Photon OS 2.0: Rsyslog PHSA-2019-2.0-0182	Nessus	PhotonOS Local Security Checks	Local	critical

Detections

Analytics

CVE-2019-17040

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical