Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
centosCentOS ProjectCESA-2020:1000
HistoryApr 08, 2020 - 7:16 p.m.

rsyslog security update

2020-04-0819:16:23
CentOS Project
lists.centos.org
278

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.007 Low

EPSS

Percentile

80.5%

JSON

CentOS Errata and Security Advisory CESA-2020:1000

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format.

Security Fix(es):

  • rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c (CVE-2019-17041)

  • rsyslog: heap-based overflow in contrib/pmcisconames/pmcisconames.c (CVE-2019-17042)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes linked from the References section.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-cr-announce/2020-April/032664.html

Affected packages:
rsyslog
rsyslog-crypto
rsyslog-doc
rsyslog-elasticsearch
rsyslog-gnutls
rsyslog-gssapi
rsyslog-kafka
rsyslog-libdbi
rsyslog-mmaudit
rsyslog-mmjsonparse
rsyslog-mmkubernetes
rsyslog-mmnormalize
rsyslog-mmsnmptrapd
rsyslog-mysql
rsyslog-pgsql
rsyslog-relp
rsyslog-snmp
rsyslog-udpspoof

Upstream details at:
https://access.redhat.com/errata/RHSA-2020:1000

OSVersionArchitecturePackageVersionFilename
CentOS7x86_64rsyslog< 8.24.0-52.el7rsyslog-8.24.0-52.el7.x86_64.rpm
CentOS7x86_64rsyslog-crypto< 8.24.0-52.el7rsyslog-crypto-8.24.0-52.el7.x86_64.rpm
CentOS7noarchrsyslog-doc< 8.24.0-52.el7rsyslog-doc-8.24.0-52.el7.noarch.rpm
CentOS7x86_64rsyslog-elasticsearch< 8.24.0-52.el7rsyslog-elasticsearch-8.24.0-52.el7.x86_64.rpm
CentOS7x86_64rsyslog-gnutls< 8.24.0-52.el7rsyslog-gnutls-8.24.0-52.el7.x86_64.rpm
CentOS7x86_64rsyslog-gssapi< 8.24.0-52.el7rsyslog-gssapi-8.24.0-52.el7.x86_64.rpm
CentOS7x86_64rsyslog-kafka< 8.24.0-52.el7rsyslog-kafka-8.24.0-52.el7.x86_64.rpm
CentOS7x86_64rsyslog-libdbi< 8.24.0-52.el7rsyslog-libdbi-8.24.0-52.el7.x86_64.rpm
CentOS7x86_64rsyslog-mmaudit< 8.24.0-52.el7rsyslog-mmaudit-8.24.0-52.el7.x86_64.rpm
CentOS7x86_64rsyslog-mmjsonparse< 8.24.0-52.el7rsyslog-mmjsonparse-8.24.0-52.el7.x86_64.rpm
Rows per page:
1-10 of 181

Related

openvas 18
nessus 31
oraclelinux 2
suse 2
osv 5
amazon 1
redhat 2
debian 2
ibm 2
mageia 1
ubuntu 1
fedora 2
photon 6
f5 2
redhatcve 2
ubuntucve 2
prion 2
nvd 2
cve 2
alpinelinux 2
debiancve 2
cvelist 2
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2020:0512-1)
2021-04-19 00:00:00
SUSE: Security Advisory (SUSE-SU-2019:2937-1)
2021-06-09 00:00:00
Huawei EulerOS: Security Advisory for rsyslog (EulerOS-SA-2020-1218)
2020-03-13 00:00:00
nessus
nessus
RHEL 6 : rsyslog (Unpatched Vulnerability)
2024-05-11 00:00:00
EulerOS 2.0 SP3 : rsyslog (EulerOS-SA-2019-2659)
2019-12-18 00:00:00
CentOS 7 : rsyslog (CESA-2020:1000)
2020-04-10 00:00:00
oraclelinux
oraclelinux
rsyslog security, bug fix, and enhancement update
2020-04-06 00:00:00
rsyslog security, bug fix, and enhancement update
2020-05-05 00:00:00
suse
suse
Security update for rsyslog (moderate)
2019-11-13 00:00:00
Security update for rsyslog (moderate)
2019-11-14 00:00:00
osv
osv
rsyslog - security update
2021-11-30 00:00:00
rsyslog - security update
2019-10-09 00:00:00
rsyslog vulnerabilities
2022-05-12 08:43:35
amazon
amazon
Medium: rsyslog
2020-06-26 22:55:00
redhat
redhat
(RHSA-2020:1702) Moderate: rsyslog security, bug fix, and enhancement update
2020-04-28 09:06:43
(RHSA-2020:1000) Moderate: rsyslog security, bug fix, and enhancement update
2020-03-31 09:06:41
debian
debian
[SECURITY] [DLA 2835-1] rsyslog security update
2021-11-30 23:36:30
[SECURITY] [DLA 1952-1] rsyslog security update
2019-10-10 00:12:14
ibm
ibm
Security Bulletin: Vulnerabilities in Rsyslog affect IBM Spectrum Protect Plus (CVE-2019-17041, CVE-2019-17042)
2020-08-31 19:31:37
Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities
2021-08-13 22:15:02
mageia
mageia
Updated rsyslog packages fix security vulnerabilities
2019-12-19 16:44:26
ubuntu
ubuntu
Rsyslog vulnerabilities
2022-05-12 00:00:00
fedora
fedora
[SECURITY] Fedora 30 Update: rsyslog-8.1911.0-1.fc30
2019-11-24 01:15:08
[SECURITY] Fedora 31 Update: rsyslog-8.1911.0-1.fc31
2019-11-22 00:48:23
photon
photon
Critical Photon OS Security Update - PHSA-2019-0256
2019-10-31 00:00:00
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2019-2.0-0184
2019-10-23 00:00:00
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2019-1.0-0254
2019-10-18 00:00:00
f5
f5
K12213311 : Rsyslog v8.1908.0.0 vulnerability CVE-2019-17041
2020-01-15 00:00:00
K39081000 : Rsyslog vulnerability CVE-2019-17042
2020-01-30 00:00:00
redhatcve
redhatcve
CVE-2019-17042
2020-04-03 02:09:53
CVE-2019-17041
2019-10-29 16:55:56
ubuntucve
ubuntucve
CVE-2019-17041
2019-10-07 00:00:00
CVE-2019-17042
2019-10-07 00:00:00
prion
prion
Heap overflow
2019-10-07 16:15:00
Heap overflow
2019-10-07 16:15:00
nvd
nvd
CVE-2019-17041
2019-10-07 16:15:11
CVE-2019-17042
2019-10-07 16:15:11
cve
cve
CVE-2019-17041
2019-10-07 16:15:11
CVE-2019-17042
2019-10-07 16:15:11
alpinelinux
alpinelinux
CVE-2019-17041
2019-10-07 16:15:11
CVE-2019-17042
2019-10-07 16:15:11
debiancve
debiancve
CVE-2019-17041
2019-10-07 16:15:11
CVE-2019-17042
2019-10-07 16:15:11
cvelist
cvelist
CVE-2019-17041
2019-10-07 15:31:17
CVE-2019-17042
2019-10-07 15:34:04

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.007 Low

EPSS

Percentile

80.5%

JSON
Related for CESA-2020:1000
openvas18nessus31oraclelinux2suse2osv5amazon1redhat2debian2ibm2mageia1ubuntu1fedora2photon6f52redhatcve2ubuntucve2prion2nvd2cve2alpinelinux2debiancve2cvelist2