Skip to content
OpenAdvisories
High ELSA-2022-4799 1 CVE

Important: rsyslog security update (Oracle Linux 8)

Published May 30, 2022 · Updated May 30, 2022

Ecosystem: Oracle Linux

Summary

[8.2102.0-7.1]
- Address CVE-2022-24903, Heap-based overflow in TCP syslog server
resolves: rhbz#2081400

Fixed packages 20

ReleasePackageFixed in
Oracle Linux · 8 rsyslog 0:8.2102.0-7.el8_6.1
Oracle Linux · 8 rsyslog-crypto 0:8.2102.0-7.el8_6.1
Oracle Linux · 8 rsyslog-doc 0:8.2102.0-7.el8_6.1
Oracle Linux · 8 rsyslog-elasticsearch 0:8.2102.0-7.el8_6.1
Oracle Linux · 8 rsyslog-gnutls 0:8.2102.0-7.el8_6.1
Oracle Linux · 8 rsyslog-gssapi 0:8.2102.0-7.el8_6.1
Oracle Linux · 8 rsyslog-kafka 0:8.2102.0-7.el8_6.1
Oracle Linux · 8 rsyslog-mmaudit 0:8.2102.0-7.el8_6.1
Oracle Linux · 8 rsyslog-mmfields 0:8.2102.0-7.el8_6.1
Oracle Linux · 8 rsyslog-mmjsonparse 0:8.2102.0-7.el8_6.1
Oracle Linux · 8 rsyslog-mmkubernetes 0:8.2102.0-7.el8_6.1
Oracle Linux · 8 rsyslog-mmnormalize 0:8.2102.0-7.el8_6.1
Oracle Linux · 8 rsyslog-mmsnmptrapd 0:8.2102.0-7.el8_6.1
Oracle Linux · 8 rsyslog-mysql 0:8.2102.0-7.el8_6.1
Oracle Linux · 8 rsyslog-omamqp1 0:8.2102.0-7.el8_6.1
Oracle Linux · 8 rsyslog-openssl 0:8.2102.0-7.el8_6.1
Oracle Linux · 8 rsyslog-pgsql 0:8.2102.0-7.el8_6.1
Oracle Linux · 8 rsyslog-relp 0:8.2102.0-7.el8_6.1
Oracle Linux · 8 rsyslog-snmp 0:8.2102.0-7.el8_6.1
Oracle Linux · 8 rsyslog-udpspoof 0:8.2102.0-7.el8_6.1

Vulnerabilities 1

  • High 8.1
    CVE-2022-24903 Public exploit

    Buffer overflow in TCP syslog server (receiver) components in rsyslog

    Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability…

    rsyslog rsyslog rsyslog rsyslog Debian Ubuntu Azure Linux Alpine