SUSE-SU-2022:2331-1

HIGH8.1

Security update for rsyslog

Published Jul 7, 2022

Modified 3 years ago

Fix available

Details

Description of the patch:

This update for rsyslog fixes the following issues:

CVE-2022-24903: fix potential heap buffer overflow in modules for TCP syslog reception (bsc#1199061)

Affected Packages(11 packages)

rsyslog

SUSE Linux Enterprise Server 12 SP3-BCLSUSE Linux Enterprise Server 12 SP3-LTSSSUSE Linux Enterprise Server 12 SP4-LTSSSUSE Linux Enterprise Server for SAP Applications 12 SP3SUSE Linux Enterprise Server for SAP Applications 12 SP4

Fixed in:

8.24.0-3.58.2

rsyslog-diag-tools

Fixed in:

8.24.0-3.58.2

rsyslog-doc

Fixed in:

8.24.0-3.58.2

rsyslog-module-gssapi

Fixed in:

8.24.0-3.58.2

rsyslog-module-gtls

Fixed in:

8.24.0-3.58.2

rsyslog-module-mysql

Fixed in:

8.24.0-3.58.2

rsyslog-module-pgsql

Fixed in:

8.24.0-3.58.2

rsyslog-module-relp

Fixed in:

8.24.0-3.58.2

rsyslog-module-snmp

Fixed in:

8.24.0-3.58.2

rsyslog-module-udpspoof

Fixed in:

8.24.0-3.58.2

References

ADVISORY

https://bugzilla.suse.com/1199061

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2022-July/011474.html

ADVISORY

https://www.suse.com/security/cve/CVE-2022-24903/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2022/suse-su-20222331-1/

CVSS Analysis

CVSS v3.1

8.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

8.1/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Upstream

CVE-2022-24903

Ecosystems(9)

SUSE Linux Enterprise Server 12 SP3-BCL SUSE Linux Enterprise Server 12 SP3-LTSS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4

Timeline

PublishedJul 7, 2022

ModifiedJul 7, 2022

SUSE-SU-2022:2331-1 | Mondoo Vulnerability Intelligence