openSUSE 16: rsyslog / rsyslog-devel / rsyslog-diag-tools / rsyslog-module-dtls / etc (openSUSE-SU-2026:22184-1)

high Nessus Plugin ID 374764

Synopsis

The remote openSUSE host is missing one or more security updates.

Description

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22184-1 advisory.

- CVE-2026-19654: imptcp regex-framing remote denial of service (bsc#1271910).
- CVE-2026-61548: crafted RFC 5424 messages to mmpstrucdata can lead to a stack overwrite (bsc#1272414).
- CVE-2026-78002: RainerScript replace() heap buffer overflow (bsc#1275926).
- CVE-2026-92709: `omfile` `dynaFile` template uses a value influenced by untrusted input as a path component without explicit secure-path handling, which can lead to arbitrary code execution (bsc#1286926).
- RainerScript replace() length wrap (bsc#1285036).

Changes for rsyslog:

- added new rsyslog (imdtls/omdtls) DTLS modules (jsc#PED-16623)
- upgrade to rsyslog 8.2608.0 (bsc#1257604)
* 2026-08-18: imbeats: rearm listener after failed TLS accept
* 2026-08-18: msg: serialize turbo snapshot duplication
* 2026-08-18: omfile: harden dynafile default containment
* 2026-08-18: fixup! omfwd: support PKCS#11 URIs with ossl TLS
* 2026-07-02: omfwd: support PKCS#11 URIs with ossl TLS
* 2026-07-21: mmkubernetes: reload SA token proactively and on HTTP 401
* 2026-08-17: devtools: remove Cubic from local validation
* 2026-08-14: mmnormalize: share turbo $! snapshot across MsgDup by refcount
* 2026-08-11: tcpsrv: synchronize session table slots
* 2026-08-11: imrelp: preserve errno across stop signal
* 2026-08-12: examples.rst: Missing space in template
* 2026-08-10: mmnormalize: merge debug metadata
* 2026-08-08: normalizers: complete debug test gating
* 2026-08-08: normalizers: complete debug integration
* 2026-08-07: mmnormalize, pmnormalize: add liblognorm debugging
* 2026-08-07: msg: ignore null values in msgSetPropViaJSON() instead of crashing
* 2026-08-07: runtime: make error-message flag atomic
* 2026-07-24: fuzz: exercise RFC 3164 and RFC 5424 parsers
* 2026-08-05: build: unify indentation in AC_CONFIG_FILES list
* 2026-07-25: imfile: fix delay.message microsecond conversion
* 2026-07-24: diskqueue: reject symlinked persisted segments
* 2026-06-23: omfile: control symlink following
* 2026-07-25: mmnormalize: make HUP reload worker-safe
* 2026-07-24: docs(agents): add Cursor Cloud environment setup notes
* 2026-07-22: imbeats: harden Lumberjack input resource handling
* 2026-07-23: stringbuf: harden empty string replacement
* 2026-07-20: imptcp: guard regex framing match at line start (CVE-2026-19654 bsc#1271910)
* 2026-07-21: rainerscript: free cnfstmtNewAct nvlst once, at the done: label
* 2026-07-21: queue: preserve DA child work during shutdown
* 2026-07-21: imtcp: release completed zlib decoder state
* 2026-07-09: doc: clarify JSON array rendering
* 2026-07-21: Potential fixes for 5 code quality findings (#7397)
* 2026-07-20: ratelimit: optimize port-based per-source keys
* 2026-07-20: imtcp: make zstd window budget configurable
* 2026-07-19: imtcp: use snake case for zstd window tracking
* 2026-07-17: imtcp: bound aggregate zstd decoder window memory
* 2026-07-20: statsobj: guard Prometheus escape writes
* 2026-07-18: config: do not instantiate actions disabled via config.enabled=off
* 2026-07-15: queue: document DA engine internals
* 2026-07-14: msg: enforce source-property helper contract
* 2026-07-10: ratelimit: remove per-source key policy hot lock
* 2026-07-08: ratelimit: speed source-key shortcuts
* 2026-07-15: queue: clarify DA transfer worker role
* 2026-07-18: compat_queue: add missing STAILQ_FOREACH/STAILQ_NEXT fallback
* 2026-07-18: rainerscript: warn on constant AND/OR operand at parse time
* 2026-07-18: configure: include <stddef.h> in the STAILQ detection test
* 2026-07-17: mmnormalize: share Turbo CEE root path check
* 2026-07-17: mmnormalize: fall back after Turbo materialization failure
* 2026-07-17: mmnormalize: preserve turbo results across message boundaries
* 2026-07-17: benchmarks: harden comparison and helper inputs
* 2026-07-16: segdisk: optimize CRC accounting and add benchmarks
* 2026-07-15: imjournal: stop invalidation reopen busy-loop
* 2026-07-14: queue: harden segmented DA lifecycle invariants
* 2026-07-14: queue: harden DA portability and startup cleanup
* 2026-07-14: queue: address segmented DA review findings
* 2026-07-14: queue: stabilize DA shutdown and reload state
* 2026-07-14: queue: clarify lazy marker and legacy state paths
* 2026-07-14: queue: gate idle cleanup on durable intent
* 2026-07-14: queue: document empty DA marker replacement
* 2026-07-14: queue: preserve classic state on transient load errors
* 2026-07-14: queue: make idle cleanup restoration crash safe
* 2026-07-14: queue: fail classic DA startup on real errors
* 2026-07-14: queue: clarify dirty DA configuration handling
* 2026-07-14: queue: separate DA idle and worker timeouts
* 2026-07-14: queue: document DA auto-upgrade boundary
* 2026-07-14: queue: publish fresh DA markers on first spill
* 2026-07-14: queue: constrain classic DA startup fallback
* 2026-07-14: queue: clarify disabled DA idle timeout
* 2026-07-14: queue: preserve classic DA startup fallback
* 2026-07-14: doc: describe segmented disk-assisted queues
* 2026-07-14: queue: add segmented disk-assisted engine
* 2026-07-14: queue: retain adopted recovery frontier
* 2026-07-14: queue: address segmented disk review findings
* 2026-07-13: queue: wake workers before capacity waits
* 2026-07-13: queue: make segmented deletion resumable
* 2026-07-13: queue: initialize missing state in empty spool dirs
* 2026-07-13: queue: reject invalid segmented codec field types
* 2026-07-13: queue: avoid sanitized generation wrap
* 2026-07-13: queue: expose segmented disk durability test hooks
* 2026-07-13: queue: make segmented disk recovery lazy
* 2026-07-09: queue: rework experimental segmented disk backend
* 2026-07-08: imjournal: warn when failing to get the MESSAGE field
* 2026-07-08: omawslogshlc: add CloudWatch Logs HLC output module
* 2026-07-08: core: add systemd READY delay opt-in
* 2026-06-02: core/imfile: synchronize sd_notify READY=1 with module startup
* 2026-07-07: ratelimit: shard per-source state
* 2026-07-06: docs: validate marked config samples
* 2026-07-07: ratelimit: shard named config registry
* 2026-07-06: runtime: harden ratelimit per-source reload
* 2026-07-06: queue: align legacy action batch default
* 2026-07-06: runtime: relax worker-count log reads
* 2026-07-06: core: relax selected atomic flag reads
* 2026-07-06: omkafka: relax poll stop flag atomics
* 2026-07-06: doc: add documentation for imfile delay.message parameter
* 2026-06-04: core: add generic output rate limiting
* 2026-07-05: omelasticsearch: apply TLS options during detection
* 2026-06-24: omprog: pace transaction retry resumes
* 2026-07-02: runtime: add relaxed 32-bit atomic helpers
* 2026-07-02: runtime: fix uint64 atomic fallback return
* 2026-07-02: net: match legacy allowed sender hostname handling
* 2026-07-02: runtime: modernize atomic helper usage
* 2026-07-02: net: add modern allowedSender ACLs
* 2026-07-02: queue: keep DA child workers alive while idle
* 2026-07-01: runtime: add atomic read load helpers
* 2026-07-01: rainerscript: align hex escape lexer states
* 2026-06-30: rainerscript: accept hex object string escapes
* 2026-06-30: runtime: synchronize action retry shutdown state
* 2026-06-30: mmutf8fix: fix replacement sequence examples
* 2026-06-16: parser: preserve first sanitize offset with SpaceLF
* 2026-06-29: template: avoid new legacy octal escape
* 2026-06-29: Make imptcp-epoll-add-failure.sh Linux-only
* 2026-06-29: Use check_LTLIBRARIES to generate liboverride_* test libraries
* 2026-06-29: doc: correct tcp_user_timeout version marker
* 2026-06-23: omhttp: continue after permanent data failures
* 2026-06-28: ommail: harden subject template header output
* 2026-06-28: omprog/omstdout: guard empty template LF checks
* 2026-06-23: tcp: skip legacy z after stream decode
* 2026-06-26: omelasticsearch: escape bulk metadata values
* 2026-06-24: imtcp: bound zstd decoder window
* 2026-06-24: mmkubernetes: add kubernetesurl failover
* 2026-06-26: docs: add v8-stable patch-flow skill to stable branch
* 2026-06-26: impcap: bound-check ARP address lengths
* 2026-06-26: Initialize devcontainer option state
* 2026-06-26: Remove obsolete Ubuntu 18.04 dev containers
* 2026-06-26: Refresh dev container cleanup
* 2026-06-26: agent: add v8-stable patch flow skill
* 2026-06-26: ChangeLog: split include-glob follow-up
* 2026-06-26: config: keep empty include globs silent
* 2026-06-26: gtls: harden DNS SAN byte handling
* 2026-06-25: Codify timeoutGuard testbench invariant
* 2026-06-26: imhttp: enforce gzip request body limit
* 2026-06-24: imhttp: defensive fixes and auth fallback correction
* 2026-06-25: doc/release: prevent invalid release version manual change
* 2026-06-24: omelasticsearch: add tls.tlsversion, tls.ciphersuites, tls.keyexchangegroups
* 2026-06-24: input: warn for rulesets without queues
* 2026-06-24: ommongodb: preserve ISODate fractional seconds
* 2026-06-24: imuxsock: clarify missing Socket diagnostics
* 2026-06-24: rsyslogd: reject -o output over input config
* 2026-06-24: template: add timereceived property alias
* 2026-06-24: imudp: store received sockaddr length
* 2026-06-23: imfile: warn on duplicate file monitors
* 2026-06-24: omudpspoof: stop retrying failed fragments
* 2026-06-23: gtls: guard early debug-level lookup (bsc#1274610)
* 2026-06-23: statsobj: handle lock control failures
* 2026-06-23: build: avoid empty usertools install dirs
* 2026-06-23: imdocker: recover from stale since anchors
* 2026-06-23: tcpflood: add GnuTLS priority string option
* 2026-06-23: imjournal: add journal namespace support
* 2026-06-23: prepare for next scheduled stable release cycle
* 2026-06-23: doc: clarify omprog transaction mode status
* 2026-06-23: errmsg: enrich oversize errorfile records
* 2026-06-23: omelasticsearch: retry read-only bulk failures
* 2026-06-23: doc: clarify fromhost case handling
* 2026-06-23: doc: clarify ommysql data failures
* 2026-06-23: omuxsock: isolate action socket locks
* 2026-06-16: template: add octal control character escape
* 2026-06-16: omfwd: add TCP user timeout action option
* 2026-06-15: mmutf8fix: support replacement sequences
* 2026-06-09: [Modernization] Replace Internal Backticks with Shell Expansion: Rscript Batch 1
* 2026-06-08: diag.sh: fix content-pattern-check and assert-first-column-sum-greater-than
* 2026-06-23: imtcp: add stream compression support
* 2026-06-23: docs: add queue-full troubleshooting
* 2026-06-22: mmpstrucdata: document structured-data buffer invariant
* 2026-06-21: doc: refine object terminator wording
* 2026-06-21: doc: clarify security release handling
* 2026-06-21: doc: clarify RainerScript semicolon use
* 2026-06-20: rainerscript: escape embedded NULs at C-string boundary
* 2026-06-20: doc: explain service sandboxing for helpers
* 2026-06-20: doc: address service sandboxing review
* 2026-06-20: Apply suggested fix to tools/pmrfc3164.c from Copilot Autofix
* 2026-06-19: rainerscript: fold constant comparisons
* 2026-06-18: doc: clarify partial config validation
* 2026-06-18: config: warn on constant boolean operands
* 2026-06-17: parser: honor parseHostnameAndTag in RFC3164 parser
* 2026-06-17: core: fix negated exact priority filters
* 2026-06-16: rainerscript: keep random result non-negative
* 2026-06-16: rainerscript: add cbool function
* 2026-06-16: pmrfc3164: honor parseHostnameAndTag at runtime
* 2026-06-16: msg: invalidate programname when tag changes
* 2026-06-16: imfile: deliver same-file monitors independently
* 2026-06-16: glbl: keep debug logfile notice informational
* 2026-06-16: doc: modernize GELF forwarding tutorial
* 2026-06-15: ommail: add SMTP mode test
* 2026-06-15: mmjsonparse: modernize test output paths
* 2026-06-14: parser: add optional trailing CR stripping
* 2026-06-14: ompgsql: accept long server hostnames
* 2026-06-14: dynstats: warn on duplicate bucket names
* 2026-06-14: action: warn on duplicate action names
* 2026-06-13: omfwd: use matching atomic mutex helper
* 2026-06-08: Merge pull request #7014 from rsyslog/cursor/critical-correctness-bugs-480c
* 2026-06-05: omazureeventhubs docs: fix underscored parameters
* 2026-06-04: runtime: fix YAML promotion OOM ownership
* 2026-06-04: omuxsock docs: correct template parameter
* 2026-06-04: omhttp: own Splunk profile template names
* 2026-06-04: mmjsonparse: reject boundary trailing data
* 2026-06-04: mmdblookup: preserve uint64 values
* 2026-06-04: mmdblookup: check uint64 fallback formatting
* 2026-06-04: impstats docs: fix dotted log parameters
* 2026-06-04: impstats docs: clarify parameter name guidance
* 2026-06-04: imkafka: stop workers on startup failure
* 2026-06-04: imkafka: refine startup stop flag handling
* 2026-06-04: doc: match Sphinx duplicate CLI override handling
* 2026-06-04: doc: keep stable git docs out of dev mode
* 2026-06-04: doc: format stable rst_prolog metadata
* 2026-06-04: doc: fix database tutorial SQL template option
* 2026-06-03: regexp: avoid per-thread shutdown double-free
* 2026-06-03: omkafka: fix NULL topic and add action name to onDestroy flush logs
* 2026-06-03: mmsnareparse: honor searchWindow in tabbed trailing scan
* 2026-06-03: mmsnareparse: cap tab trailing search by token
* 2026-06-03: imfifo: guard absent module config paths
* 2026-06-03: imfifo: bind instances to module config
* 2026-06-03: imdiag: fix stats reporting gate
* 2026-06-03: imdiag: avoid checked cond signal while locked
* 2026-06-03: docker: gate collector imtcp module
* 2026-06-03: docker: derive single imtcp enable switch
* 2026-06-03: docker: default derived imtcp switch in collector
* 2026-06-02: yamlconf: clean up include recursion guard
* 2026-06-02: tls: propagate wolfSSL send-side read retry
* 2026-06-02: tls: keep wolfSSL send retry local
* 2026-06-02: tls: bound wolfSSL send-side read retries
* 2026-06-02: sidecar: cap UDP burst buffer by total bytes
* 2026-06-02: runtime: include limits.h for INT_MAX in yamlconf
* 2026-06-02: runtime: guard against recursive YAML includes
* 2026-06-02: runtime/queue: reset sizeOnDisk after safe recovery
* 2026-06-02: rainerscript: accept optimizer NOP statements
* 2026-06-02: omkafka: fix HUP deadlock when doAction holds mut_doAction (#7129)
* 2026-06-02: omhttp: avoid retry-ruleset self-stall
* 2026-06-02: omhiredis: fix TLS context error log
* 2026-06-02: mmpstrucdata: support custom SD containers (CVE-2026-61548 bsc#1272414)
* 2026-06-02: mmjsonparse: fix find-json ownership and scan bounds
* 2026-06-02: mmjsonparse: clear JSON pointer after ownership transfer
* 2026-06-02: devtools: fold local review experiment into planner
* 2026-06-01: translate: cover script serialization (#7152)
* 2026-06-01: dev_env: include lcov in Ubuntu coverage images
* 2026-06-01: ChangeLog: update 8.2606 entries
* 2026-06-01: Add parse_time_localtz with documentation
* 2026-05-31: runtime: join final worker after shutdown wait
* 2026-05-31: runtime: harden raw message replacement growth
* 2026-05-31: runtime: fix $!all-json serialization locking
* 2026-05-31: ratelimit: centralize per-source enforcement
* 2026-05-31: parser: fix NetAddr cleanup on mask parse errors
* 2026-05-31: omclickhouse: report HTTP response errors
* 2026-05-31: omclickhouse: document SQL template option
* 2026-05-31: omclickhouse: clean up JSON root on OOM
* 2026-05-31: action: avoid committing suspended retry batches
* 2026-05-31: Keep transactional action queue messages on shutdown
* 2026-05-30: rainerscript: add tocef() and cef_ext_escape() for CEF output
* 2026-05-30: doc: clarify queue crash durability limits
* 2026-05-30: devtools: add read-only C format check
* 2026-05-29: tls: propagate send-side receive retry
* 2026-05-29: tls: preserve send-side receive retry state
* 2026-05-29: tls: preserve send retry without reconnect
* 2026-05-29: tls: keep wolfSSL send-side retry local
* 2026-05-29: tls: keep send-side read retries local
* 2026-05-29: template: apply style-check formatting
* 2026-05-29: style: format msg replacement tests
* 2026-05-29: runtime: fix msg replace helper CI failures
* 2026-05-29: omkafka: fix suspension not triggered on host resolution failure
* 2026-05-29: omfwd: schedule retry for deferred TCP flush
* 2026-05-29: omfwd: preserve connection on retryable TLS sends
* 2026-05-29: omfwd: avoid tcpclt leak on rebind
* 2026-05-29: mmsnareparse: preserve regex end-anchor semantics
* 2026-05-29: imudp: validate listen port formatting
* 2026-05-29: imudp: harden listen port file writes
* 2026-05-29: imptcp: simplify compression auto probe
* 2026-05-29: imkafka: support multiple topics in one input() instance
* 2026-05-29: imjournal: warn when newest entry is in the future
* 2026-05-29: imjournal: handle clock jumps in future probe
* 2026-05-29: docs: strengthen GHSA prompt guardrails
* 2026-05-29: add func doFunct_ParseTimeLocalTz
* 2026-05-29: Update doc/security/ghsa-coordination-review-template.md
* 2026-05-29: Fix rawmsg suffix shift on realloc
* 2026-05-29: Fix msg replacement and JSON set handling
* 2026-05-29: Apply suggested fix to tests/mmexternal-response-too-long.sh from Copilot Autofix
* 2026-05-28: tls: keep send retry state internal
* 2026-05-28: template: reject invalid regex match selectors
* 2026-05-28: template: guard NULL property rendering
* 2026-05-28: packaging: use ETL Vespa env defaults directly
* 2026-05-28: packaging: default ETL TLS envs in entrypoint
* 2026-05-28: omelasticsearch: apply clang-format to version probe error
* 2026-05-28: mmjsontransform: fix dotted conflict ownership
* 2026-05-28: mmexternal: fix single-instance reply handling
* 2026-05-28: mmexternal: fix EINTR reply handling
* 2026-05-28: mmdblookup: clean up failed worker creation
* 2026-05-28: imuxsock: handle embedded NUL datagrams safely
* 2026-05-28: imptcp: harden auto compression probe
* 2026-05-27: tls: preserve recv data during send-side reads
* 2026-05-27: tls: avoid recv-helper misuse in send WANT_READ
* 2026-05-27: tls: avoid receive retry state during send
* 2026-05-27: template: fix jsonftree flat fallback framing
* 2026-05-27: runtime: reject embedded NULs in mbedtls cert names
* 2026-05-27: runtime: initialize ratelimit mutex once
* 2026-05-27: runtime: guard per-thread regexp iterator allocation
* 2026-05-27: runtime: fix fromhost-port extraction before rcvFrom union swap
* 2026-05-27: runtime: clean up DNS props on port allocation failure
* 2026-05-27: runtime-format-regexp-lifecycle-guards
* 2026-05-27: regexp-clean-up-per-thread-entries
* 2026-05-27: packaging: expose Vespa HTTPS toggles
* 2026-05-27: packaging: enable HTTPS by default for ETL Vespa output
* 2026-05-27: omusrmsg: enable thread-safe action ratelimiter
* 2026-05-27: omotel: use getProgramName() when deriving app name
* 2026-05-27: omotel: avoid const cast for app name extraction
* 2026-05-27: ommysql: handle closed connection before commit
* 2026-05-27: omkafka: harden failed delivery replay paths
* 2026-05-27: omhttp: refresh health-check headers after gzip rebuild
* 2026-05-27: omhttp: keep health-check headers uncompressed
* 2026-05-27: omelasticsearch: bound startup version probe response size
* 2026-05-27: mmsnareparse: skip full digit runs in event probe
* 2026-05-27: mmsnareparse: preserve anchored trailing regex matches
* 2026-05-27: mmsnareparse: cap regex input in trailing token
* 2026-05-27: mmsnareparse: avoid quadratic provider scans in snare probe
* 2026-05-27: mmjsontransform: fix child ownership on dotted merge conflicts
* 2026-05-27: mmjsontransform: clean up dotted insert ownership
* 2026-05-27: mmanon: remove assert on malformed embedded IPv4
* 2026-05-27: mmanon: make random suffix generation fully reachable
* 2026-05-27: mmanon: build random suffix from byte chunks
* 2026-05-27: mbedtls-refine-nul-name-checks
* 2026-05-27: mbedtls-apply-cert-name-style
* 2026-05-27: lookup: report active table reloads as pending
* 2026-05-27: lmsig-ksi-bound-debug-precision
* 2026-05-27: imptcp: serialize helper work per session
* 2026-05-27: imptcp: add stream:auto compression mode
* 2026-05-27: imfifo: implement named pipe input module (#7029)
* 2026-05-27: dynstats: coalesce pending persistence writes per bucket
* 2026-05-27: dynstats-unlock-on-task-alloc-failure
* 2026-05-27: docker: fix clickhouse configure flag in Debian 13 dev image
* 2026-05-27: doc: use literal markup for TLS parameters
* 2026-05-27: doc: fix shutdown.enable.ctlc spelling in rsyslogd man page
* 2026-05-27: doc: fix mmrfc5424addhmac sd_id parameter name
* 2026-05-27: doc: clarify mbedtls requires StreamDriverMode=1 for TLS
* 2026-05-27: configure: detect relpCltSetKeepAlive support
* 2026-05-26: stats: avoid notifier teardown deadlocks
* 2026-05-26: runtime: guard optional regexp object lifecycle in tcp server
* 2026-05-26: runtime: bound KSI debug record logging by length
* 2026-05-26: runtime: avoid regexp unload double free
* 2026-05-26: ratelimit: avoid double free on helper error paths
* 2026-05-26: perctile: reuse counter cleanup helper
* 2026-05-26: perctile: link buckets after initialization
* 2026-05-26: ossl: avoid caching OCSP responses past nextUpdate
* 2026-05-26: omazuredce: bound HTTP response buffering
* 2026-05-26: omazuredce: avoid gzip buffer underallocation
* 2026-05-26: omazuredce-review-followup
* 2026-05-26: imuxsock: enforce ratelimit.name for credentialed senders
* 2026-05-26: imuxsock-ratelimit-credential-followup
* 2026-05-26: impstats: fix double-free in remote write batching cleanup
* 2026-05-26: imkafka: cap split.json.records fan-out
* 2026-05-26: imdocker: keep stream alive on rate-limit drops
* 2026-05-26: imdocker: bound multiline segment compaction
* 2026-05-26: imdocker: apply clang-format output
* 2026-05-26: configure: avoid leaking -lgcrypt into global LIBS
* 2026-05-25: shellcheck: fix masked test assignments
* 2026-05-25: runtime: validate numeric hardening inputs
* 2026-05-25: runtime/nsd_gtls: validate IP SAN length before conversion
* 2026-05-25: parser: verify and fix offAfterPRI calculation
* 2026-05-25: omhiredis: derive TLS server name from server config
* 2026-05-25: omfwd: require peers for targetSrv TLS name auth
* 2026-05-25: omfwd: clarify targetSrv TLS auth error
* 2026-05-25: nsd_gtls: preserve SAN-present state for malformed IP SAN
* 2026-05-25: imhttp: write bound listener port to file
* 2026-05-25: imdtls: write bound listener port to file
* 2026-05-25: fix(imhiredis): default TLS peer name to configured server
* 2026-05-24: tools: make AIX SRC reply copy bounded
* 2026-05-24: statsobj: clear lock flag after prometheus unlock
* 2026-05-24: runtime: clamp emulated RFC5424 tag length
* 2026-05-24: runtime: avoid post-fork malloc in execProg
* 2026-05-24: runtime/statsobj: lock stats list during iteration
* 2026-05-24: nsd_mbedtls: reject RemoteSNI and wire interface
* 2026-05-24: nsd_mbedtls: fill remote port interface methods
* 2026-05-24: mmjsontransform: track per-insert conflicts
* 2026-05-24: mmjsontransform: avoid leak on policy insert conflict
* 2026-05-24: mmjsonparse: avoid json double-free on add failure
* 2026-05-24: mmexternal: avoid undrained stdout/stderr pipe in output=none mode
* 2026-05-24: mmexternal: address output pipe review findings
* 2026-05-24: impstats: harden overwrite temp file creation
* 2026-05-24: imjournal: treat rate-limit discards as non-fatal in readjournal
* 2026-05-24: gssapi: use uint32_t for token wire length
* 2026-05-24: gssapi: fix token length framing endianness in sender
* 2026-05-24: fix(tools): guard AIX SRC reply text against NULL
* 2026-05-23: rainerscript: fix array and numeric comparisons on JSON vars
* 2026-05-23: privdrop: update privilege drop comments
* 2026-05-23: privdrop: log capability context on drop failure
* 2026-05-23: omelasticsearch: guard dynamic template strings
* 2026-05-23: omelasticsearch: cache action template count
* 2026-05-23: imjournal: restore cursor after recovery reopen
* 2026-05-23: imjournal: recover from stale saved cursor
* 2026-05-23: imjournal: harden journal invalidation recovery
* 2026-05-23: imjournal: avoid rotation accounting during recovery
* 2026-05-23: docs: clarify local validation gates
* 2026-05-23: contrib, runtime: defensive stability and robustness hardening
* 2026-05-23: codex: wire local container testing hook into agent workflow
* 2026-05-22: shell: clean up ShellCheck findings
* 2026-05-22: python: clean up style and add optional checks
* 2026-05-22: net_ossl: document SAN-priority hard-stop on old API
* 2026-05-22: msg: guard MSG replacement offsets (bsc#1272414)
* 2026-05-22: mmexternal: support one-way helpers and response timeouts
* 2026-05-22: imptcp: unlink failed accepted sessions
* 2026-05-22: imjournal: fix double-free hazards on JSON objects
* 2026-05-22: imfile: add line-number metadata and soften empty checks
* 2026-05-22: imdocker: terminate compacted multiline buffers
* 2026-05-22: imbeats: harden pointer transfer in submitEvent
* 2026-05-22: contrib, plugins: refine pointer hand-off in imhiredis, mmjsonparse, mmsequence
* 2026-05-22: contrib, plugins: defensive pointer hand-off hardening
* 2026-05-22: config: warn for unmatched include globs
* 2026-05-22: agents: document optional local linters
* 2026-05-21: template: harden property rendering bounds
* 2026-05-21: tcpsrv: guard listener destructors against NULL references
* 2026-05-21: tcps_sess: secure regex memory reallocation and destructor
* 2026-05-21: style: format wolfSSL CRL helper
* 2026-05-21: ruleset: guard synchronous recursive calls
* 2026-05-21: rainerscript: harden string and JSON bounds
* 2026-05-21: pm/fm: defensively harden parsing edge cases
* 2026-05-21: ossl: enable wolfSSL CRL checks for DER files
* 2026-05-21: net_ossl: avoid CN fallback when SAN priority unsupported
* 2026-05-21: mmgrok: keep configured source immutable
* 2026-05-21: lookup: harden shutdown lifecycle
* 2026-05-21: imudp: harden thread lifecycles and fix stats memory leak
* 2026-05-21: imtcp: harden listener setup and legacy c ...

Please note that the description has been truncated due to length. Please refer to vendor advisory for the full description.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 374764

File Name: openSUSE-2026-22184-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 11/1/2026

Updated: 11/1/2026

Supported Sensors: Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.13

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-92709

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:rsyslog-devel, p-cpe:/a:novell:opensuse:rsyslog-diag-tools, p-cpe:/a:novell:opensuse:rsyslog-module-dtls, p-cpe:/a:novell:opensuse:rsyslog-module-elasticsearch, p-cpe:/a:novell:opensuse:rsyslog-module-gcrypt, p-cpe:/a:novell:opensuse:rsyslog-module-gssapi, p-cpe:/a:novell:opensuse:rsyslog-module-gtls, p-cpe:/a:novell:opensuse:rsyslog-module-mmnormalize, p-cpe:/a:novell:opensuse:rsyslog-module-mysql, p-cpe:/a:novell:opensuse:rsyslog-module-omhttpfs, p-cpe:/a:novell:opensuse:rsyslog-module-omtcl, p-cpe:/a:novell:opensuse:rsyslog-module-ossl, p-cpe:/a:novell:opensuse:rsyslog-module-pgsql, p-cpe:/a:novell:opensuse:rsyslog-module-relp, p-cpe:/a:novell:opensuse:rsyslog

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/29/2026

Vulnerability Publication Date: 7/30/2026

Reference Information

CVE: CVE-2026-19654, CVE-2026-61548, CVE-2026-78002, CVE-2026-92709

IAVA: 2026-A-0775-S, 2026-A-0983

Detections

Analytics