Summary
Bas van Schaik and Kevin Backhouse discovered that librelp incorrectly
handled checking certain x509 certificates. A remote attacker able to
connect to rsyslog could possibly use this issue to execute arbitrary code.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | librelp | 1.2.2-2ubuntu1.1 |
Vulnerabilities 1
-
Unscored —CVE-2018-1000140 Public exploit
rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificate…
References
-
report
https://ubuntu.com/security/CVE-2018-1000140