CVE-2017-12588
rsyslog: multiple format string vulnerabilities in zmq3 modules
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Photon OS (yüksek), Red Hat (orta).
Açıklama
The zmq3 input and output modules in rsyslog before 8.28.0 interpreted description fields as format strings, possibly allowing a format string attack with unspecified impact.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| debian 11 | rsyslog | 8.28.0-1 |
| debian 12 | rsyslog | 8.28.0-1 |
| debian 13 | rsyslog | 8.28.0-1 |
| debian 14 | rsyslog | 8.28.0-1 |
| echo | rsyslog | 8.28.0-1 |
| Photon OS 1.0 | rsyslog | 8.15.0-6.ph1 |
| Photon OS 2.0 | rsyslog | 8.26.0-2.ph2 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2017-12588
- https://github.com/rsyslog/rsyslog/blob/master/ChangeLog
- https://github.com/rsyslog/rsyslog/commit/062d0c671a29f7c6f7dff4a2f1f35df375bbb30b
- https://github.com/rsyslog/rsyslog/pull/1565
- https://nvd.nist.gov/vuln/detail/CVE-2017-12588
- https://security.netapp.com/advisory/ntap-20241227-0009/
- https://www.cve.org/CVERecord?id=CVE-2017-12588