CVE-2019-17041
published 2019-10-07CVE-2019-17041: An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The…
PriorityP348critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
4.57%
90.6th percentile
An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | rsyslog | < rsyslog 8.1910.0-1 (bookworm) | rsyslog 8.1910.0-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
| rsyslog | rsyslog | — | — |
| rsyslog | rsyslog | >= 0 < 8.1910.0-1 | 8.1910.0-1 |
| rsyslog | rsyslog | >= 0 < 8.1910.0-1 | 8.1910.0-1 |
| rsyslog | rsyslog | >= 0 < 8.1910.0-1 | 8.1910.0-1 |
| rsyslog | rsyslog | >= 0 < 8.1910.0-1 | 8.1910.0-1 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Rsyslog vulnerabilities
vendor_ubuntu·2022-05-12
CVE-2018-16881 Rsyslog vulnerabilities
Title: Rsyslog vulnerabilities
Summary: Rsyslog could be made to crash if it received specially crafted input.
It was discovered that Rsyslog improperly handled certain invalid input. An
attacker could use this issue to cause Rsyslog to crash.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c
vendor_redhat·2019-09-30·CVSS 9.8
CVE-2019-17041 [CRITICAL] CWE-122 rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c
rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c
An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the cont
Debian
CVE-2019-17041: rsyslog - An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixfo...
vendor_debian·2019·CVSS 9.8
CVE-2019-17041 [CRITICAL] CVE-2019-17041: rsyslog - An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixfo...
An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to
GHSA
GHSA-wvqp-mg76-5qw7: An issue was discovered in Rsyslog v8
ghsa_unreviewed·2022-05-24
CVE-2019-17041 [HIGH] CWE-120 GHSA-wvqp-mg76-5qw7: An issue was discovered in Rsyslog v8
An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to
OSV
CVE-2019-17041: An issue was discovered in Rsyslog v8
osv·2019-10-07·CVSS 9.8
CVE-2019-17041 [CRITICAL] CVE-2019-17041: An issue was discovered in Rsyslog v8
An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-17041 rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c [fedora-all]
bugzilla·2019-10-29·CVSS 9.8
CVE-2019-17041 [CRITICAL] CVE-2019-17041 rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c [fedora-all]
CVE-2019-17041 rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affec
Bugzilla
CVE-2019-17041 rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c
bugzilla·2019-10-29·CVSS 9.8
CVE-2019-17041 [CRITICAL] CVE-2019-17041 rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c
CVE-2019-17041 rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c
An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shif
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-11/msg00032.htmlhttps://github.com/rsyslog/rsyslog/blob/v8-stable/ChangeLoghttps://github.com/rsyslog/rsyslog/pull/3884https://lists.debian.org/debian-lts-announce/2021/11/msg00030.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPNCHI7X2IEXRH6RYD6IDPR4PLB5RPC7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6SUQE25RD37CD24BHKUWMG27U5RQ2FU/http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-11/msg00032.htmlhttps://github.com/rsyslog/rsyslog/blob/v8-stable/ChangeLoghttps://github.com/rsyslog/rsyslog/pull/3884https://lists.debian.org/debian-lts-announce/2021/11/msg00030.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPNCHI7X2IEXRH6RYD6IDPR4PLB5RPC7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6SUQE25RD37CD24BHKUWMG27U5RQ2FU/
2019-10-07
Published