-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: rsyslog security, bug fix, and enhancement update Advisory ID: RHSA-2020:1000-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:1000 Issue date: 2020-03-31 CVE Names: CVE-2019-17041 CVE-2019-17042 ===================================================================== 1. Summary: An update for rsyslog is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - noarch, x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - noarch, x86_64 3. Description: The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format. Security Fix(es): * rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c (CVE-2019-17041) * rsyslog: heap-based overflow in contrib/pmcisconames/pmcisconames.c (CVE-2019-17042) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1549706 - rsyslog SEGV with disk-assisted queues, possible corruption 1600171 - Rsyslog omelasticsearch does not work with ES 6.x strict headers 1684236 - rsyslog-8.24.0-34.el7.x86_64 SIGSEGV when using rsyslog-elasticsearch-8.24.0-34 1714094 - rsyslog causes memory leak 1744617 - Memory leak in readjournal() when cs.bWorkAroundJournalBug = 1 1744682 - rsyslog: imfile crash on log rotation 1744856 - truncation detected, (cannot seek backward to begin of last block) - re-start reading from beginning: Inappropriate ioctl for device 1763746 - rsyslog doesn't read lines from imfile after rotation of logs 1766693 - CVE-2019-17041 rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c 1766700 - CVE-2019-17042 rsyslog: heap-based overflow in contrib/pmcisconames/pmcisconames.c 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: rsyslog-8.24.0-52.el7.src.rpm x86_64: rsyslog-8.24.0-52.el7.x86_64.rpm rsyslog-debuginfo-8.24.0-52.el7.x86_64.rpm rsyslog-gnutls-8.24.0-52.el7.x86_64.rpm rsyslog-gssapi-8.24.0-52.el7.x86_64.rpm rsyslog-kafka-8.24.0-52.el7.x86_64.rpm rsyslog-mmjsonparse-8.24.0-52.el7.x86_64.rpm rsyslog-relp-8.24.0-52.el7.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): noarch: rsyslog-doc-8.24.0-52.el7.noarch.rpm x86_64: rsyslog-crypto-8.24.0-52.el7.x86_64.rpm rsyslog-debuginfo-8.24.0-52.el7.x86_64.rpm rsyslog-elasticsearch-8.24.0-52.el7.x86_64.rpm rsyslog-libdbi-8.24.0-52.el7.x86_64.rpm rsyslog-mmaudit-8.24.0-52.el7.x86_64.rpm rsyslog-mmkubernetes-8.24.0-52.el7.x86_64.rpm rsyslog-mmnormalize-8.24.0-52.el7.x86_64.rpm rsyslog-mmsnmptrapd-8.24.0-52.el7.x86_64.rpm rsyslog-mysql-8.24.0-52.el7.x86_64.rpm rsyslog-pgsql-8.24.0-52.el7.x86_64.rpm rsyslog-snmp-8.24.0-52.el7.x86_64.rpm rsyslog-udpspoof-8.24.0-52.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: rsyslog-8.24.0-52.el7.src.rpm x86_64: rsyslog-8.24.0-52.el7.x86_64.rpm rsyslog-debuginfo-8.24.0-52.el7.x86_64.rpm rsyslog-gnutls-8.24.0-52.el7.x86_64.rpm rsyslog-gssapi-8.24.0-52.el7.x86_64.rpm rsyslog-kafka-8.24.0-52.el7.x86_64.rpm rsyslog-mmjsonparse-8.24.0-52.el7.x86_64.rpm rsyslog-relp-8.24.0-52.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): noarch: rsyslog-doc-8.24.0-52.el7.noarch.rpm x86_64: rsyslog-crypto-8.24.0-52.el7.x86_64.rpm rsyslog-debuginfo-8.24.0-52.el7.x86_64.rpm rsyslog-elasticsearch-8.24.0-52.el7.x86_64.rpm rsyslog-libdbi-8.24.0-52.el7.x86_64.rpm rsyslog-mmaudit-8.24.0-52.el7.x86_64.rpm rsyslog-mmkubernetes-8.24.0-52.el7.x86_64.rpm rsyslog-mmnormalize-8.24.0-52.el7.x86_64.rpm rsyslog-mmsnmptrapd-8.24.0-52.el7.x86_64.rpm rsyslog-mysql-8.24.0-52.el7.x86_64.rpm rsyslog-pgsql-8.24.0-52.el7.x86_64.rpm rsyslog-snmp-8.24.0-52.el7.x86_64.rpm rsyslog-udpspoof-8.24.0-52.el7.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: rsyslog-8.24.0-52.el7.src.rpm ppc64: rsyslog-8.24.0-52.el7.ppc64.rpm rsyslog-debuginfo-8.24.0-52.el7.ppc64.rpm rsyslog-gnutls-8.24.0-52.el7.ppc64.rpm rsyslog-gssapi-8.24.0-52.el7.ppc64.rpm rsyslog-kafka-8.24.0-52.el7.ppc64.rpm rsyslog-mysql-8.24.0-52.el7.ppc64.rpm rsyslog-pgsql-8.24.0-52.el7.ppc64.rpm rsyslog-relp-8.24.0-52.el7.ppc64.rpm ppc64le: rsyslog-8.24.0-52.el7.ppc64le.rpm rsyslog-debuginfo-8.24.0-52.el7.ppc64le.rpm rsyslog-gnutls-8.24.0-52.el7.ppc64le.rpm rsyslog-gssapi-8.24.0-52.el7.ppc64le.rpm rsyslog-kafka-8.24.0-52.el7.ppc64le.rpm rsyslog-mysql-8.24.0-52.el7.ppc64le.rpm rsyslog-pgsql-8.24.0-52.el7.ppc64le.rpm rsyslog-relp-8.24.0-52.el7.ppc64le.rpm s390x: rsyslog-8.24.0-52.el7.s390x.rpm rsyslog-debuginfo-8.24.0-52.el7.s390x.rpm rsyslog-gnutls-8.24.0-52.el7.s390x.rpm rsyslog-gssapi-8.24.0-52.el7.s390x.rpm rsyslog-kafka-8.24.0-52.el7.s390x.rpm rsyslog-mysql-8.24.0-52.el7.s390x.rpm rsyslog-pgsql-8.24.0-52.el7.s390x.rpm rsyslog-relp-8.24.0-52.el7.s390x.rpm x86_64: rsyslog-8.24.0-52.el7.x86_64.rpm rsyslog-debuginfo-8.24.0-52.el7.x86_64.rpm rsyslog-gnutls-8.24.0-52.el7.x86_64.rpm rsyslog-gssapi-8.24.0-52.el7.x86_64.rpm rsyslog-kafka-8.24.0-52.el7.x86_64.rpm rsyslog-mmjsonparse-8.24.0-52.el7.x86_64.rpm rsyslog-mysql-8.24.0-52.el7.x86_64.rpm rsyslog-pgsql-8.24.0-52.el7.x86_64.rpm rsyslog-relp-8.24.0-52.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): noarch: rsyslog-doc-8.24.0-52.el7.noarch.rpm ppc64: rsyslog-crypto-8.24.0-52.el7.ppc64.rpm rsyslog-debuginfo-8.24.0-52.el7.ppc64.rpm rsyslog-elasticsearch-8.24.0-52.el7.ppc64.rpm rsyslog-libdbi-8.24.0-52.el7.ppc64.rpm rsyslog-mmaudit-8.24.0-52.el7.ppc64.rpm rsyslog-mmjsonparse-8.24.0-52.el7.ppc64.rpm rsyslog-mmkubernetes-8.24.0-52.el7.ppc64.rpm rsyslog-mmnormalize-8.24.0-52.el7.ppc64.rpm rsyslog-mmsnmptrapd-8.24.0-52.el7.ppc64.rpm rsyslog-snmp-8.24.0-52.el7.ppc64.rpm rsyslog-udpspoof-8.24.0-52.el7.ppc64.rpm ppc64le: rsyslog-crypto-8.24.0-52.el7.ppc64le.rpm rsyslog-debuginfo-8.24.0-52.el7.ppc64le.rpm rsyslog-elasticsearch-8.24.0-52.el7.ppc64le.rpm rsyslog-libdbi-8.24.0-52.el7.ppc64le.rpm rsyslog-mmaudit-8.24.0-52.el7.ppc64le.rpm rsyslog-mmjsonparse-8.24.0-52.el7.ppc64le.rpm rsyslog-mmkubernetes-8.24.0-52.el7.ppc64le.rpm rsyslog-mmnormalize-8.24.0-52.el7.ppc64le.rpm rsyslog-mmsnmptrapd-8.24.0-52.el7.ppc64le.rpm rsyslog-snmp-8.24.0-52.el7.ppc64le.rpm rsyslog-udpspoof-8.24.0-52.el7.ppc64le.rpm s390x: rsyslog-crypto-8.24.0-52.el7.s390x.rpm rsyslog-debuginfo-8.24.0-52.el7.s390x.rpm rsyslog-elasticsearch-8.24.0-52.el7.s390x.rpm rsyslog-libdbi-8.24.0-52.el7.s390x.rpm rsyslog-mmaudit-8.24.0-52.el7.s390x.rpm rsyslog-mmjsonparse-8.24.0-52.el7.s390x.rpm rsyslog-mmkubernetes-8.24.0-52.el7.s390x.rpm rsyslog-mmnormalize-8.24.0-52.el7.s390x.rpm rsyslog-mmsnmptrapd-8.24.0-52.el7.s390x.rpm rsyslog-snmp-8.24.0-52.el7.s390x.rpm rsyslog-udpspoof-8.24.0-52.el7.s390x.rpm x86_64: rsyslog-crypto-8.24.0-52.el7.x86_64.rpm rsyslog-debuginfo-8.24.0-52.el7.x86_64.rpm rsyslog-elasticsearch-8.24.0-52.el7.x86_64.rpm rsyslog-libdbi-8.24.0-52.el7.x86_64.rpm rsyslog-mmaudit-8.24.0-52.el7.x86_64.rpm rsyslog-mmkubernetes-8.24.0-52.el7.x86_64.rpm rsyslog-mmnormalize-8.24.0-52.el7.x86_64.rpm rsyslog-mmsnmptrapd-8.24.0-52.el7.x86_64.rpm rsyslog-snmp-8.24.0-52.el7.x86_64.rpm rsyslog-udpspoof-8.24.0-52.el7.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: rsyslog-8.24.0-52.el7.src.rpm x86_64: rsyslog-8.24.0-52.el7.x86_64.rpm rsyslog-debuginfo-8.24.0-52.el7.x86_64.rpm rsyslog-gnutls-8.24.0-52.el7.x86_64.rpm rsyslog-gssapi-8.24.0-52.el7.x86_64.rpm rsyslog-kafka-8.24.0-52.el7.x86_64.rpm rsyslog-mmjsonparse-8.24.0-52.el7.x86_64.rpm rsyslog-mysql-8.24.0-52.el7.x86_64.rpm rsyslog-pgsql-8.24.0-52.el7.x86_64.rpm rsyslog-relp-8.24.0-52.el7.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): noarch: rsyslog-doc-8.24.0-52.el7.noarch.rpm x86_64: rsyslog-crypto-8.24.0-52.el7.x86_64.rpm rsyslog-debuginfo-8.24.0-52.el7.x86_64.rpm rsyslog-elasticsearch-8.24.0-52.el7.x86_64.rpm rsyslog-libdbi-8.24.0-52.el7.x86_64.rpm rsyslog-mmaudit-8.24.0-52.el7.x86_64.rpm rsyslog-mmkubernetes-8.24.0-52.el7.x86_64.rpm rsyslog-mmnormalize-8.24.0-52.el7.x86_64.rpm rsyslog-mmsnmptrapd-8.24.0-52.el7.x86_64.rpm rsyslog-snmp-8.24.0-52.el7.x86_64.rpm rsyslog-udpspoof-8.24.0-52.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-17041 https://access.redhat.com/security/cve/CVE-2019-17042 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXoObMNzjgjWX9erEAQiJpQ//WsR3UYm2a8MctAOeo4kyHLKcWXsVdemk 6cCeYE1Pumvl/L+UCwXIkwRXZyRZAeXvmxXfs6w9+/iQCBlaq69V2IG/RlQ1YjKK jNJHw4MXF4eF8PqOKMc65WPrAhW+YepJs4+KEebrc+Z2Ht2PxRV9R/X5P5JF1LAm 3DhI5IbsZmLSoLVaq06wWCP6KzNApP/k0IEZ6a/QI1KQ22h0IJJnLpkYlt0t+3ry nKRjadtI/2WTLP3grJG+3EsgZqV00zB/npYPZmF5Db6arlujGorvLVZ+4P+FAoc7 6qzYPuprNmRwvYpUUzzDgz78rYjkJKPrPLUD2T02SQq7VNgal1ekb8vuCDjzmcOz xaUPeIu5sRRfUeDO+MlGRNhuUchkrAIJRI7s2nAOztvBPgbDAX17BVCSg2+W+VWZ 720X4x5zrXR3w4xlEikPkmex1iP7Jbw8WQxCcwV32XM0T1wy66Ig4lUz6v+mjyjZ nrcVS3v1x0s7Xapy6rkoiA8DMnvxzSN2dT2eRKhofjzLjlE4t4+mjyQvZn7QXfsz Vud6YMN4Qa4XGWuJuY5DdSjNozxrO4feG8KZ6PBmuAY/i1vCCSNn5p358/eZB9BY 5sjXYxtGAXzAmzdeUf+SaPQxZyaCuerzsAB6QfVYp8ixZcEwJWSiEDj5N2cxjjrG 8OmzuyWeDZ4= =YCMf -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce