Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitylow

rsyslog RainerScript replace() output length overflow (GHSA-48f2-29wv-5jgc)

oss-security ()1
Read at seclists.org
AI summary · grok-4.7-buildSummaries by Vani AI

rsyslog disclosed a RainerScript replace() output-length overflow that default small-message configurations do not expose.

rsyslog disclosed GHSA-48f2-29wv-5jgc, an output-length overflow in the RainerScript replace() function. The three-argument form of wrap() uses the same helper. The issue is not exposed by rsyslog's default small-message configuration. An affected deployment must use an explicit ruleset that passes attacker-influenced values to replace() or three-argument wrap(), and set maxMessageSize large enough to accept the source and replacement values.

Key facts
  • GHSA-48f2-29wv-5jgc is an output-length overflow in RainerScript replace().
  • The three-argument wrap() form uses the same helper.
  • Default small-message configurations are not exposed.
  • Exploitation needs an attacker-influenced ruleset and a large maxMessageSize.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
rsyslograinerscriptoverflowghsasyslog
Products
rsyslog
Organizations
rsyslog

From the original article

Posted by Rainer Gerhards on Oct 13 Hello, rsyslog has disclosed GHSA-48f2-29wv-5jgc, an output length overflow in RainerScript replace(). The three-argument form of wrap() uses the same helper. This is not exposed by rsyslog's default small-message configuration.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.