CVE-2008-5617

2008-12-1702:30:00

Debian Security Bug Tracker

security-tracker.debian.org

8.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:P/A:C

0.013 Low

EPSS

Percentile

85.8%

JSON

The ACL handling in rsyslog 3.12.1 to 3.20.0, 4.1.0, and 4.1.1 does not follow $AllowedSender directive, which allows remote attackers to bypass intended access restrictions and spoof log messages or create a large number of spurious messages.

OSVersionArchitecturePackageVersionFilename
Debian12allrsyslog< 3.18.6-1rsyslog_3.18.6-1_all.deb
Debian11allrsyslog< 3.18.6-1rsyslog_3.18.6-1_all.deb
Debian10allrsyslog< 3.18.6-1rsyslog_3.18.6-1_all.deb
Debian999allrsyslog< 3.18.6-1rsyslog_3.18.6-1_all.deb
Debian13allrsyslog< 3.18.6-1rsyslog_3.18.6-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	rsyslog	< 3.18.6-1	rsyslog_3.18.6-1_all.deb
Debian	11	all	rsyslog	< 3.18.6-1	rsyslog_3.18.6-1_all.deb
Debian	10	all	rsyslog	< 3.18.6-1	rsyslog_3.18.6-1_all.deb
Debian	999	all	rsyslog	< 3.18.6-1	rsyslog_3.18.6-1_all.deb
Debian	13	all	rsyslog	< 3.18.6-1	rsyslog_3.18.6-1_all.deb