Control: retitle -1 trixie-pu: package rsyslog/8.2504.0-1+deb13u2
Hi,
I fixed two more CVEs and uploaded them as 8.2504.0-1+deb13u2
The changelog reads:
* rainerscript: Avoid heap buffer overflow in replace() function.
Patch cherry-picked from upstream Git.
(CVE-2026-78002, Closes: #1145980)
* mmpstrucdata: Fix stack buffer overflow with oversized RFC5424
structured
data.
Patch backported from upstream Git.
(CVE-2026-61548)
Updated debdiff is attached.
Regards,
Michael
Am 24.08.26 um 16:04 schrieb Michael Biebl:
Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:rsyslog User: [email protected] Usertags: pu Hi, I'd like to make a stable upload for rsyslog. The changelog reads: * omfwd regression fix: avoid false active target change log message. Patch backported from upstream Git. (Closes: #1141981) * imptcp: reject invalid regex-framing recovery transitions. (CVE-2026-19654, Closes: #1144616) The patches are as minimal as possible to minimize the regression potential. CVE-2026-19654 / #1144616 was filed by the security team. We concluded to fix this via a stable upload. Regards Michael
diff --git a/debian/changelog b/debian/changelog index 4916e31e5..14930e3c5 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,24 @@ +rsyslog (8.2504.0-1+deb13u2) trixie; urgency=medium + + * rainerscript: Avoid heap buffer overflow in replace() function. + Patch cherry-picked from upstream Git. + (CVE-2026-78002, Closes: #1145980) + * mmpstrucdata: Fix stack buffer overflow with oversized RFC5424 structured + data. + Patch backported from upstream Git. + (CVE-2026-61548) + + -- Michael Biebl <[email protected]> Sun, 30 Aug 2026 02:19:20 +0200 + +rsyslog (8.2504.0-1+deb13u1) trixie; urgency=medium + + * omfwd regression fix: avoid false active target change log message. + Patch backported from upstream Git. (Closes: #1141981) + * imptcp: reject invalid regex-framing recovery transitions. + (CVE-2026-19654, Closes: #1144616) + + -- Michael Biebl <[email protected]> Mon, 24 Aug 2026 15:56:02 +0200 + rsyslog (8.2504.0-1) unstable; urgency=medium * New upstream version 8.2504.0 diff --git a/debian/gbp.conf b/debian/gbp.conf index 05e704d03..3477505d6 100644 --- a/debian/gbp.conf +++ b/debian/gbp.conf @@ -1,5 +1,5 @@ [DEFAULT] pristine-tar = True patch-numbers = False -debian-branch = debian/master +debian-branch = debian/trixie upstream-branch = upstream/latest diff --git a/debian/patches/imptcp-guard-regex-framing-match-at-line-start.patch b/debian/patches/imptcp-guard-regex-framing-match-at-line-start.patch new file mode 100644 index 000000000..bb7d7b262 --- /dev/null +++ b/debian/patches/imptcp-guard-regex-framing-match-at-line-start.patch @@ -0,0 +1,44 @@ +From: Rainer Gerhards <[email protected]> +Date: Mon, 20 Jul 2026 17:19:28 +0200 +Subject: imptcp: guard regex framing match at line start + +Why +A regex match at the beginning of the receive buffer can form a +negative message length after oversize-frame recovery. + +Impact +Regex-framed imptcp listeners reject that invalid transition instead +of submitting a negative message length. + +Before/After +Before: a match with a zero line offset submitted an invalid length. +After: only a match following an existing line can submit a frame. + +Technical Overview +Mirror the line-offset guard used by the shared imtcp parser. +Leave existing regex framing and oversize recovery behavior unchanged. + +Security advisory: +https://github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7w29 + +Reported-by: Raphael Eikenberg (@eikendev) +With the help of AI-Agents: Codex + +(cherry picked from commit 07b3c40a5a78c79ed9109251f842ca7e955dd586) +--- + plugins/imptcp/imptcp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/plugins/imptcp/imptcp.c b/plugins/imptcp/imptcp.c +index 9223f20..16d2c32 100644 +--- a/plugins/imptcp/imptcp.c ++++ b/plugins/imptcp/imptcp.c +@@ -1054,7 +1054,7 @@ processDataRcvd_regexFraming(ptcpsess_t *const __restrict__ pThis, + pThis->iCurrLine = pThis->iMsg; + } else { + const int isMatch = !regexec(&inst->start_preg, (char*)pThis->pMsg+pThis->iCurrLine, 0, NULL, 0); +- if(isMatch) { ++ if (pThis->iCurrLine > 0 && isMatch) { + DBGPRINTF("regex match (%d), framing line: %s\n", pThis->iCurrLine, pThis->pMsg); + strcpy((char*)pThis->pMsg_save, (char*) pThis->pMsg+pThis->iCurrLine); + pThis->iMsg = pThis->iCurrLine - 1; diff --git a/debian/patches/mmpstrucdata-Fix-stack-buffer-overflow-with-oversized-RFC.patch b/debian/patches/mmpstrucdata-Fix-stack-buffer-overflow-with-oversized-RFC.patch new file mode 100644 index 000000000..f456af8fa --- /dev/null +++ b/debian/patches/mmpstrucdata-Fix-stack-buffer-overflow-with-oversized-RFC.patch @@ -0,0 +1,41 @@ +From: Rainer Gerhards <[email protected]> +Date: Tue, 2 Jun 2026 14:00:15 +0200 +Subject: mmpstrucdata: Fix stack buffer overflow with oversized RFC5424 + structured data + +Partial backport of commit bcda60a3692efdf0c8e44102528f5a0ebe0dec6d + +See https://github.com/rsyslog/rsyslog/security/advisories/GHSA-8qmr-c66f-g368 +--- + plugins/mmpstrucdata/mmpstrucdata.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/plugins/mmpstrucdata/mmpstrucdata.c b/plugins/mmpstrucdata/mmpstrucdata.c +index 5f1ca80..eb81047 100644 +--- a/plugins/mmpstrucdata/mmpstrucdata.c ++++ b/plugins/mmpstrucdata/mmpstrucdata.c +@@ -256,7 +256,7 @@ parseSD_PARAM(instanceData *const pData, uchar *sdbuf, int lenbuf, int *curridx, + { + int i; + uchar pName[33]; +- uchar pVal[32*1024]; ++ uchar *pVal = NULL; + struct json_object *jval; + DEFiRet; + +@@ -270,6 +270,7 @@ parseSD_PARAM(instanceData *const pData, uchar *sdbuf, int lenbuf, int *curridx, + ABORT_FINALIZE(RS_RET_STRUC_DATA_INVLD); + } + ++i; ++ CHKmalloc(pVal = malloc(lenbuf - i + 1)); + CHKiRet(parsePARAM_VALUE(sdbuf, lenbuf, &i, pVal)); + if(sdbuf[i] != '"') { + ABORT_FINALIZE(RS_RET_STRUC_DATA_INVLD); +@@ -281,6 +282,7 @@ parseSD_PARAM(instanceData *const pData, uchar *sdbuf, int lenbuf, int *curridx, + + *curridx = i; + finalize_it: ++ free(pVal); + RETiRet; + } + diff --git a/debian/patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch b/debian/patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch new file mode 100644 index 000000000..fa12bbf88 --- /dev/null +++ b/debian/patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch @@ -0,0 +1,41 @@ +From: Rainer Gerhards <[email protected]> +Date: Sun, 8 Jun 2025 13:04:04 +0200 +Subject: omfwd regression fix: avoid false active target change log message + +Commit ffaf6dc4620da added proper variable sync, but dropped the check +if active count had actually changed. As such, the output was always +generated, which could pollute the log heavily. + +Code style fixes where dropped for the backport. + +(cherry picked from commit d6d340aaad6ea414a2fd4cf07d3f98c5c9334194) +--- + tools/omfwd.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/tools/omfwd.c b/tools/omfwd.c +index f4f1fdd..4e81461 100644 +--- a/tools/omfwd.c ++++ b/tools/omfwd.c +@@ -1146,15 +1146,17 @@ countActiveTargets(const wrkrInstanceData_t *const pWrkrData) { + oldVal = ATOMIC_FETCH_32BIT(&pWrkrData->pData->nActiveTargets, + &pWrkrData->pData->mut_nActiveTargets); + if (oldVal == activeTargets) { +- break; // No change needed ++ break; /* no change, so no log message either */ + } + newVal = activeTargets; + } while (!ATOMIC_CAS(&pWrkrData->pData->nActiveTargets, oldVal, newVal, + &pWrkrData->pData->mut_nActiveTargets)); + +- LogMsg(0, RS_RET_DEBUG, LOG_DEBUG, +- "omfwd: [wrkr %u] number of active targets changed from %d to %d", +- pWrkrData->wrkrID, oldVal, activeTargets); ++ if(oldVal != activeTargets) { ++ LogMsg(0, RS_RET_DEBUG, LOG_DEBUG, ++ "omfwd: [wrkr %u] number of active targets changed from %d to %d", ++ pWrkrData->wrkrID, oldVal, activeTargets); ++ } + } + + diff --git a/debian/patches/rainerscript-align-replace-sizing-rewind.patch b/debian/patches/rainerscript-align-replace-sizing-rewind.patch new file mode 100644 index 000000000..4eda136ea --- /dev/null +++ b/debian/patches/rainerscript-align-replace-sizing-rewind.patch @@ -0,0 +1,43 @@ +From: Rainer Gerhards <[email protected]> +Date: Thu, 20 Aug 2026 15:53:16 +0200 +Subject: rainerscript: align replace sizing rewind + +Why: +The sizing pass skipped a candidate match that the copy pass replaced. + +Impact: +Overlapping partial matches now receive a correctly sized output string. + +Before/After: +Before, the two passes resumed at different source offsets; after, both +resume at the same offset. + +Technical Overview: +Make the sizing pass rewind both its source index and tentative output +length by the full failed partial-match length. This mirrors the copy pass +and ensures that every replacement counted is also written exactly once. +The change preserves the existing empty-find, replacement, and trailing +partial-match behavior. + +With the help of AI-Agents: Codex + +(cherry picked from commit 667e3f61aec5ee02c5c2ee6f0f8accf6fe4301a9) +--- + grammar/rainerscript.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grammar/rainerscript.c b/grammar/rainerscript.c +index 88c47e5..037b3f6 100644 +--- a/grammar/rainerscript.c ++++ b/grammar/rainerscript.c +@@ -1761,8 +1761,8 @@ doFuncReplace(struct svar *__restrict__ const operandVal, struct svar *__restric + if (src_buff[i] == find[j]) { + j++; + } else if (j > 0) { +- i -= (j - 1); +- lDst -= (j - 1); ++ i -= j; ++ lDst -= j; + j = 0; + } + } diff --git a/debian/patches/series b/debian/patches/series index 85d824260..f2b4664b5 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,3 +1,7 @@ Don-t-create-a-database.patch Increase-timeouts-in-imfile-basic-2GB-file-and-imfile-tru.patch Revert-queue-emit-better-warning-messages-on-queue-param-.patch +omfwd-regression-fix-avoid-false-active-target-change-log.patch +imptcp-guard-regex-framing-match-at-line-start.patch +rainerscript-align-replace-sizing-rewind.patch +mmpstrucdata-Fix-stack-buffer-overflow-with-oversized-RFC.patch
OpenPGP_signature.asc
Description: OpenPGP digital signature
