Your message dated Sat, 12 Sep 2026 08:05:41 +0000
with message-id <[email protected]>
and subject line Released in 13.7
has caused the Debian Bug report #1145386,
regarding trixie-pu: package rsyslog/8.2504.0-1+deb13u2
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1145386: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1145386
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:rsyslog
User: [email protected]
Usertags: pu
Hi,
I'd like to make a stable upload for rsyslog.
The changelog reads:
* omfwd regression fix: avoid false active target change log message.
Patch backported from upstream Git. (Closes: #1141981)
* imptcp: reject invalid regex-framing recovery transitions.
(CVE-2026-19654, Closes: #1144616)
The patches are as minimal as possible to minimize the regression
potential.
CVE-2026-19654 / #1144616 was filed by the security team. We concluded
to fix this via a stable upload.
Regards
Michael
diff --git a/debian/changelog b/debian/changelog
index 4916e31e5..b57f5c82a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+rsyslog (8.2504.0-1+deb13u1) trixie; urgency=medium
+
+ * omfwd regression fix: avoid false active target change log message.
+ Patch backported from upstream Git. (Closes: #1141981)
+ * imptcp: reject invalid regex-framing recovery transitions.
+ (CVE-2026-19654, Closes: #1144616)
+
+ -- Michael Biebl <[email protected]> Mon, 24 Aug 2026 15:56:02 +0200
+
rsyslog (8.2504.0-1) unstable; urgency=medium
* New upstream version 8.2504.0
diff --git a/debian/gbp.conf b/debian/gbp.conf
index 05e704d03..3477505d6 100644
--- a/debian/gbp.conf
+++ b/debian/gbp.conf
@@ -1,5 +1,5 @@
[DEFAULT]
pristine-tar = True
patch-numbers = False
-debian-branch = debian/master
+debian-branch = debian/trixie
upstream-branch = upstream/latest
diff --git
a/debian/patches/imptcp-guard-regex-framing-match-at-line-start.patch
b/debian/patches/imptcp-guard-regex-framing-match-at-line-start.patch
new file mode 100644
index 000000000..bb7d7b262
--- /dev/null
+++ b/debian/patches/imptcp-guard-regex-framing-match-at-line-start.patch
@@ -0,0 +1,44 @@
+From: Rainer Gerhards <[email protected]>
+Date: Mon, 20 Jul 2026 17:19:28 +0200
+Subject: imptcp: guard regex framing match at line start
+
+Why
+A regex match at the beginning of the receive buffer can form a
+negative message length after oversize-frame recovery.
+
+Impact
+Regex-framed imptcp listeners reject that invalid transition instead
+of submitting a negative message length.
+
+Before/After
+Before: a match with a zero line offset submitted an invalid length.
+After: only a match following an existing line can submit a frame.
+
+Technical Overview
+Mirror the line-offset guard used by the shared imtcp parser.
+Leave existing regex framing and oversize recovery behavior unchanged.
+
+Security advisory:
+https://github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7w29
+
+Reported-by: Raphael Eikenberg (@eikendev)
+With the help of AI-Agents: Codex
+
+(cherry picked from commit 07b3c40a5a78c79ed9109251f842ca7e955dd586)
+---
+ plugins/imptcp/imptcp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/plugins/imptcp/imptcp.c b/plugins/imptcp/imptcp.c
+index 9223f20..16d2c32 100644
+--- a/plugins/imptcp/imptcp.c
++++ b/plugins/imptcp/imptcp.c
+@@ -1054,7 +1054,7 @@ processDataRcvd_regexFraming(ptcpsess_t *const
__restrict__ pThis,
+ pThis->iCurrLine = pThis->iMsg;
+ } else {
+ const int isMatch = !regexec(&inst->start_preg,
(char*)pThis->pMsg+pThis->iCurrLine, 0, NULL, 0);
+- if(isMatch) {
++ if (pThis->iCurrLine > 0 && isMatch) {
+ DBGPRINTF("regex match (%d), framing line: %s\n",
pThis->iCurrLine, pThis->pMsg);
+ strcpy((char*)pThis->pMsg_save, (char*)
pThis->pMsg+pThis->iCurrLine);
+ pThis->iMsg = pThis->iCurrLine - 1;
diff --git
a/debian/patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch
b/debian/patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch
new file mode 100644
index 000000000..fa12bbf88
--- /dev/null
+++
b/debian/patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch
@@ -0,0 +1,41 @@
+From: Rainer Gerhards <[email protected]>
+Date: Sun, 8 Jun 2025 13:04:04 +0200
+Subject: omfwd regression fix: avoid false active target change log message
+
+Commit ffaf6dc4620da added proper variable sync, but dropped the check
+if active count had actually changed. As such, the output was always
+generated, which could pollute the log heavily.
+
+Code style fixes where dropped for the backport.
+
+(cherry picked from commit d6d340aaad6ea414a2fd4cf07d3f98c5c9334194)
+---
+ tools/omfwd.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/tools/omfwd.c b/tools/omfwd.c
+index f4f1fdd..4e81461 100644
+--- a/tools/omfwd.c
++++ b/tools/omfwd.c
+@@ -1146,15 +1146,17 @@ countActiveTargets(const wrkrInstanceData_t *const
pWrkrData) {
+ oldVal = ATOMIC_FETCH_32BIT(&pWrkrData->pData->nActiveTargets,
+ &pWrkrData->pData->mut_nActiveTargets);
+ if (oldVal == activeTargets) {
+- break; // No change needed
++ break; /* no change, so no log message either */
+ }
+ newVal = activeTargets;
+ } while (!ATOMIC_CAS(&pWrkrData->pData->nActiveTargets, oldVal, newVal,
+ &pWrkrData->pData->mut_nActiveTargets));
+
+- LogMsg(0, RS_RET_DEBUG, LOG_DEBUG,
+- "omfwd: [wrkr %u] number of active targets changed from %d to
%d",
+- pWrkrData->wrkrID, oldVal, activeTargets);
++ if(oldVal != activeTargets) {
++ LogMsg(0, RS_RET_DEBUG, LOG_DEBUG,
++ "omfwd: [wrkr %u] number of active targets changed from
%d to %d",
++ pWrkrData->wrkrID, oldVal, activeTargets);
++ }
+ }
+
+
diff --git a/debian/patches/series b/debian/patches/series
index 85d824260..103373665 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,3 +1,5 @@
Don-t-create-a-database.patch
Increase-timeouts-in-imfile-basic-2GB-file-and-imfile-tru.patch
Revert-queue-emit-better-warning-messages-on-queue-param-.patch
+omfwd-regression-fix-avoid-false-active-target-change-log.patch
+imptcp-guard-regex-framing-match-at-line-start.patch
--- End Message ---
--- Begin Message ---
Version: 13.7
This update was released as part of 13.7.
--- End Message ---
