CVEvulnerability
CVE-2018-1000140
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2018-03-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-787
Description
rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.
Affected configurations
• rsyslog librelp (<= 1.2.14)
• debian debian linux 8.0
• debian debian linux 9.0
• canonical ubuntu linux 14.04
• redhat enterprise linux desktop 6.0
• redhat enterprise linux desktop 7.0
• redhat enterprise linux server 6.0
• redhat enterprise linux server 7.0
• redhat enterprise linux server aus 6.6
• redhat enterprise linux server aus 7.2
• redhat enterprise linux server aus 7.3
• redhat enterprise linux server aus 7.4
• redhat enterprise linux server aus 7.6
• redhat enterprise linux server eus 6.7
• redhat enterprise linux server eus 7.3
• redhat enterprise linux server eus 7.4
• redhat enterprise linux server eus 7.5
• redhat enterprise linux server eus 7.6
• redhat enterprise linux server tus 6.6
• redhat enterprise linux server tus 7.2
• redhat enterprise linux server tus 7.3
• redhat enterprise linux server tus 7.4
• redhat enterprise linux server tus 7.6
• redhat enterprise linux workstation 6.0
• redhat enterprise linux workstation 7.0
Related
Weakness · CWE (1)
- CWE-787 Out-of-bounds Write weakness
References
- http://packetstormsecurity.com/files/172829/librelp-Remote-Code-Execution.html packetstormsecurity.com
- https://access.redhat.com/errata/RHSA-2018:1223 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1225 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1701 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1702 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1703 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1704 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1707 Third Party Advisory
- https://github.com/rsyslog/librelp/blob/532aa362f0f7a8d037505b0a27a1df452f9bac9e/src/tcp.c#L1205 Patch, Third Party Advisory
- https://lgtm.com/rules/1505913226124/ Exploit, Third Party Advisory
- https://security.gentoo.org/glsa/201804-21 Third Party Advisory
- https://usn.ubuntu.com/3612-1/ Third Party Advisory
- https://www.debian.org/security/2018/dsa-4151 Third Party Advisory
- http://packetstormsecurity.com/files/172829/librelp-Remote-Code-Execution.html packetstormsecurity.com
- https://access.redhat.com/errata/RHSA-2018:1223 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1225 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1701 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1702 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1703 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1704 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1707 Third Party Advisory
- https://github.com/rsyslog/librelp/blob/532aa362f0f7a8d037505b0a27a1df452f9bac9e/src/tcp.c#L1205 Patch, Third Party Advisory
- https://lgtm.com/rules/1505913226124/ Exploit, Third Party Advisory
- https://security.gentoo.org/glsa/201804-21 Third Party Advisory
- https://usn.ubuntu.com/3612-1/ Third Party Advisory
- https://www.debian.org/security/2018/dsa-4151 Third Party Advisory