Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-93404: An SQL injection issue affects rsyslog deployments using the optional omclickhouse output module. Its built-in INSERT template used escaping that did not account for ClickHouse backslash escapes. A sender able to submit a log message routed to this action could alter the SQL sent to ClickHouse, potentially forging stored log records or evaluating expressions with the configured ClickHouse accounts privileges.
Fixed packages 23
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | rsyslog | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-crypto | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-crypto-debuginfo | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-debuginfo | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-debugsource | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-doc | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-elasticsearch | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-elasticsearch-debuginfo | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-logrotate | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-mmaudit | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-mmaudit-debuginfo | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-mmfields | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-mmfields-debuginfo | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-mmjsonparse | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-mmjsonparse-debuginfo | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-mmkubernetes | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-mmkubernetes-debuginfo | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-mmnormalize | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-mmnormalize-debuginfo | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-mmtaghostname | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-mmtaghostname-debuginfo | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-openssl | 0:8.2204.0-3.amzn2023.0.10 |
| Amazon Linux · 2023 | rsyslog-openssl-debuginfo | 0:8.2204.0-3.amzn2023.0.10 |
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-93404.html