CVE-2024-47619: syslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo.*.bar` although that is not allowed. It…

PriorityP339high7.5CVSS 3.1

AVNACLPRNUINSUCNIHAN

EPSS

0.33%

25.5th percentile

syslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo.*.bar` although that is not allowed. It is also possible to pass partial wildcards such as `foo.a*c.bar` which glib matches but should be avoided / invalidated. This issue could have an impact on TLS connections, such as in man-in-the-middle situations. Version 4.8.2 contains a fix for the issue.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	syslog-ng	< syslog-ng 3.38.1-5+deb12u1 (bookworm)	syslog-ng 3.38.1-5+deb12u1 (bookworm)
msrc	azl3_syslog-ng_4.3.1-3_on_azure_linux_3.0	—	—
msrc	cbl2_syslog-ng_3.33.2-8_on_cbl_mariner_2.0	—	—
oneidentity	syslog-ng	< 4.8.2	4.8.2
oneidentity	syslog-ng	>= 0 < 3.28.1-2+deb11u2	3.28.1-2+deb11u2
oneidentity	syslog-ng	>= 0 < 3.38.1-5+deb12u1	3.38.1-5+deb12u1
oneidentity	syslog-ng	>= 0 < 4.8.1-5	4.8.1-5
oneidentity	syslog-ng	>= 0 < 4.8.1-5	4.8.1-5
syslog-ng	syslog-ng	< 4.8.2	4.8.2

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

osv7.5HIGH

vendor_debian7.5HIGH

vendor_msrc7.5HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.