Skip to content
OpenAdvisories
Critical ALAS2-2018-998 1 CVE

Critical: librelp security update (Amazon Linux 2)

Published Apr 19, 2018 · Updated Apr 19, 2018

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1000140: rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate. 1560084: CVE-2018-1000140 librelp: Stack-based buffer overflow in relpTcpChkPeerName function in src/tcp.c

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 librelp 0:1.2.12-1.amzn2.0.1
Amazon Linux · 2 librelp-debuginfo 0:1.2.12-1.amzn2.0.1
Amazon Linux · 2 librelp-devel 0:1.2.12-1.amzn2.0.1

Vulnerabilities 1

  • Unscored —
    CVE-2018-1000140 Public exploit

    rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificate…

    librelp librelp Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-1000140.html