Description
syslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo.*.bar` although that is not allowed. It is also possible to pass partial wildcards such as `foo.a*c.bar` which glib matches but should be avoided / invalidated. This issue could have an impact on TLS connections, such as in man-in-the-middle situations. Version 4.8.2 contains a fix for the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| syslog-ng | syslog-ng | < 4.8.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | syslog-ng | 4.8.1-5 | — |
| Debian 13 | syslog-ng | 4.8.1-5 | — |
| Debian 12 | syslog-ng | 3.38.1-5+deb12u1 | — |
| Debian 11 | syslog-ng | 3.28.1-2+deb11u2 | DLA-4182-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | syslog-ng | No fix yet | — |
| Ubuntu 26.04 LTS | syslog-ng | No fix yet | — |
| Ubuntu 25.10 | syslog-ng | No fix yet | — |
| Ubuntu 24.04 LTS | syslog-ng | No fix yet | — |
| Ubuntu 22.04 LTS | syslog-ng | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | syslog-ng | No fix yet | — |
| Ubuntu 18.04 LTS | syslog-ng | No fix yet | — |
| Ubuntu 16.04 LTS | syslog-ng | No fix yet | — |
| Ubuntu 14.04 LTS | syslog-ng | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | syslog-ng | 4.8.2-1.1 | openSUSE-SU-2025:15070-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | syslog-ng | 4.3.1-3 | — |
| Azure Linux 2 (CBL-Mariner) | syslog-ng | 3.33.2-8 | — |
Advisories 5
- DLA-4182-1 syslog-ng - security update Debian Security (DSA / DLA) · Mar 9, 2026
- ICSA-26-043-06 Siemens SINEC OS CISA ICS & IT advisories · Feb 25, 2026
- SSA-089022 SSA-089022: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.3 Siemens ProductCERT · Feb 24, 2026
- openSUSE-SU-2025:15070-1 libevtlog-4_8-0-4.8.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0962 Syslog-ng: Schwachstelle ermöglicht Umgehung von Sicherheitsmechanismen BSI CERT-Bund (WID) · Nov 12, 2025
References
- https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-xr54-gx74-fghg
- https://github.com/syslog-ng/syslog-ng/commit/dadfdbecde5bfe710b0a6ee5699f96926b3f9006
- https://github.com/syslog-ng/syslog-ng/blob/b0ccc8952d333fbc2d97e51fddc0b569a15e7a7d/lib/transport/tls-verifier.c#L78-L110
- https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.8.2