Description
The ACL handling in rsyslog 3.12.1 to 3.20.0, 4.1.0, and 4.1.1 does not follow $AllowedSender directive, which allows remote attackers to bypass intended access restrictions and spoof log messages or create a large number of spurious messages.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rsyslog | 3.18.6-1 | — |
| Debian 13 | rsyslog | 3.18.6-1 | — |
| Debian 12 | rsyslog | 3.18.6-1 | — |
References
- http://www.rsyslog.com/Article327.phtml
- rsyslog-allowedsender-security-bypass(47080) vdb-entry
- http://www.rsyslog.com/Article322.phtml
- http://www.rsyslog.com/Topic4.phtml
- 32630 vdb-entry
- 32857 third-party-advisory