CVE-2018-1000140
- State
- Published
- Severity
- Not scored
- Published
- Mar 23, 2018
- Updated
- Aug 5, 2024
- Reserved
- Mar 23, 2018
Description
rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- USN-3612-1vendor-advisory
- GLSA-201804-21vendor-advisory
- https://github.com/rsyslog/librelp/blob/532aa362f0f7a8d037505b0a27a1df452f9bac9e/src/tcp.c#L1205
- RHSA-2018:1703vendor-advisory
- RHSA-2018:1704vendor-advisory
- RHSA-2018:1702vendor-advisory
- RHSA-2018:1225vendor-advisory
- RHSA-2018:1707vendor-advisory
- https://lgtm.com/rules/1505913226124/
- RHSA-2018:1223vendor-advisory
- DSA-4151vendor-advisory
- RHSA-2018:1701vendor-advisory
- http://packetstormsecurity.com/files/172829/librelp-Remote-Code-Execution.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.