rsyslog imdtls permitted-peer authorization bypass
rsyslog's imdtls module keeps DTLS sessions active when permitted-peer checks fail after a successful handshake.
Rainer Gerhards reported that rsyslog's optional imdtls input module does not enforce tls.permittedpeer after a CA-authenticated DTLS handshake when tls.authmode is "name" or "fingerprint". After SSL_accept() succeeds, a failed permitted-peer identity check only logs a warning and leaves the DTLS session active, so records continue to be read and received. The disclosure cites no CVE and does not say the flaw is being exploited.
46