OSG-SEC-2022-08-10_2 HIGH Linux rsyslog heap-based buffer overflow

Dear OSG Security Contacts,

A vulnerability in the rsyslog package which can allow a denial of service or potential remote code execution attacks has been identified.

IMPACTED VERSIONS:

Multiple rsyslog versions.

WHAT ARE THE VULNERABILITIES:

A vulnerability was found which allows an attacker to craft a malicious message leading to a heap-based buffer overflow. This issue allows the attacker to corrupt or access data stored in memory, leading to a denial of service in the rsyslog or possible remote code execution.[1]

WHAT YOU SHOULD DO:

Sites running rsyslog packages should apply updates for their systems and restart the service.

Sites running RHEL should see [1]

Sites running CentOS should also see [1]

Sites running Scientific Linux should see [2]

Sites running Debian should see [3]

Sites running Ubuntu should see [4]

Sites running RockyLinux should see [5]

Sites running Almalinux should see [6]

REFERENCES

[1] https://access.redhat.com/security/cve/CVE-2022-24903

[2] https://www.scientificlinux.org/category/sl-errata/

[3] https://security-tracker.debian.org/tracker/CVE-2022-24903

[4] http://people.canonical.com/~ubuntu-security/cve/2021/CVE-2022-24903.html

[5] https://errata.rockylinux.org/

[6] https://errata.almalinux.org/

Please contact the OSG security team at [email protected] if you have any questions or concerns.

OSG Security Team