CVE catalog

CVE-2019-17042

rsyslog: CVE-2019-17042

Severity: High · CVSS 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Oct 7, 2019, 4:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 2.98% · Oct 22, 2026

An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon), but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	rsyslog	sid	`8.2608.0-4`	fixed
Debian	rsyslog	forky	`8.2608.0-4`	fixed
Debian	rsyslog	trixie	`8.2504.0-1+deb13u2`	fixed
Debian	rsyslog	bookworm	`8.2302.0-1+deb12u1`	fixed
Ubuntu	rsyslog	14.04	`5.8.11-2ubuntu4`	vulnerable
Ubuntu	rsyslog	14.04	`7.4.4-1ubuntu1`	vulnerable
Ubuntu	rsyslog	14.04	`7.4.4-1ubuntu2`	vulnerable
Ubuntu	rsyslog	14.04	`7.4.4-1ubuntu2.1`	vulnerable
Ubuntu	rsyslog	14.04	`7.4.4-1ubuntu2.3`	vulnerable
Ubuntu	rsyslog	14.04	`7.4.4-1ubuntu2.5`	vulnerable
Ubuntu	rsyslog	14.04	`7.4.4-1ubuntu2.6`	vulnerable
Ubuntu	rsyslog	14.04	`7.4.4-1ubuntu2.7`	vulnerable
Ubuntu	rsyslog	pro	`8.16.0-1ubuntu9`	vulnerable
Ubuntu	rsyslog	pro	`8.16.0-1ubuntu10`	vulnerable
Ubuntu	rsyslog	pro	`8.32.0-1ubuntu3`	vulnerable
Ubuntu	rsyslog	pro	`8.32.0-1ubuntu4`	vulnerable
Ubuntu	rsyslog	pro	`8.32.0-1ubuntu4.2`	vulnerable
Ubuntu	rsyslog	pro	`8.32.0-1ubuntu4.2+esm1`	vulnerable
Alpine	rsyslog	3.10	`8.1904.0-r1`	fixed
Alpine	rsyslog	3.11	`8.1908.0-r1`	fixed
Alpine	rsyslog	3.12	`8.1908.0-r1`	fixed
Alpine	rsyslog	3.13	`8.1908.0-r1`	fixed
Alpine	rsyslog	3.14	`8.1908.0-r1`	fixed
Alpine	rsyslog	3.15	`8.1908.0-r1`	fixed
Alpine	rsyslog	3.16	`8.1908.0-r1`	fixed
Alpine	rsyslog	3.17	`8.1908.0-r1`	fixed
Alpine	rsyslog	3.18	`8.1908.0-r1`	fixed
Alpine	rsyslog	3.19	`8.1908.0-r1`	fixed
Alpine	rsyslog	3.20	`8.1908.0-r1`	fixed
Alpine	rsyslog	3.21	`8.1908.0-r1`	fixed
Alpine	rsyslog	3.22	`8.1908.0-r1`	fixed
Alpine	rsyslog	3.23	`8.1908.0-r1`	fixed
Alpine	rsyslog	3.24	`8.1908.0-r1`	fixed
Alpine	rsyslog	3.7	`8.31.0-r1`	fixed
Alpine	rsyslog	3.8	`8.34.0-r1`	fixed
Alpine	rsyslog	3.9	`8.40.0-r4`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	rsyslog	source	sid	`8.1910.0-1`	not yet assigned	Not reported	[942065]
Debian	rsyslog	source	forky	`8.1910.0-1`	not yet assigned	Not reported	[942065]
Debian	rsyslog	source	trixie	`8.1910.0-1`	not yet assigned	Not reported	[942065]
Debian	rsyslog	source	bookworm	`8.1910.0-1`	not yet assigned	Not reported	[942065]
Alpine	rsyslog	apk	3.10	`8.1904.0-r1`	Not reported	ALPINE-CVE-2019-17042	Not reported
Alpine	rsyslog	apk	3.11	`8.1908.0-r1`	Not reported	ALPINE-CVE-2019-17042	Not reported
Alpine	rsyslog	apk	3.12	`8.1908.0-r1`	Not reported	ALPINE-CVE-2019-17042	Not reported
Alpine	rsyslog	apk	3.13	`8.1908.0-r1`	Not reported	ALPINE-CVE-2019-17042	Not reported
Alpine	rsyslog	apk	3.14	`8.1908.0-r1`	Not reported	ALPINE-CVE-2019-17042	Not reported
Alpine	rsyslog	apk	3.15	`8.1908.0-r1`	Not reported	ALPINE-CVE-2019-17042	Not reported
Alpine	rsyslog	apk	3.16	`8.1908.0-r1`	Not reported	ALPINE-CVE-2019-17042	Not reported
Alpine	rsyslog	apk	3.17	`8.1908.0-r1`	Not reported	ALPINE-CVE-2019-17042	Not reported
Alpine	rsyslog	apk	3.18	`8.1908.0-r1`	Not reported	ALPINE-CVE-2019-17042	Not reported
Alpine	rsyslog	apk	3.19	`8.1908.0-r1`	Not reported	ALPINE-CVE-2019-17042	Not reported
Alpine	rsyslog	apk	3.20	`8.1908.0-r1`	Not reported	ALPINE-CVE-2019-17042	Not reported
Alpine	rsyslog	apk	3.21	`8.1908.0-r1`	Not reported	ALPINE-CVE-2019-17042	Not reported
Alpine	rsyslog	apk	3.22	`8.1908.0-r1`	Not reported	ALPINE-CVE-2019-17042	Not reported
Alpine	rsyslog	apk	3.23	`8.1908.0-r1`	Not reported	ALPINE-CVE-2019-17042	Not reported
Alpine	rsyslog	apk	3.24	`8.1908.0-r1`	Not reported	ALPINE-CVE-2019-17042	Not reported
Alpine	rsyslog	apk	3.7	`8.31.0-r1`	Not reported	ALPINE-CVE-2019-17042	Not reported
Alpine	rsyslog	apk	3.8	`8.34.0-r1`	Not reported	ALPINE-CVE-2019-17042	Not reported
Alpine	rsyslog	apk	3.9	`8.40.0-r4`	Not reported	ALPINE-CVE-2019-17042	Not reported

[Debian bug #942065]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[rsyslog]Fixed
Details (2)
- 8.2302.0-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
- 8.2302.0-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
[rsyslog-czmq]Fixed
Source package: [rsyslog]
Details (2)
- 8.2302.0-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
- 8.2302.0-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
[rsyslog-elasticsearch]Fixed
Source package: [rsyslog]
Details (2)
- 8.2302.0-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
- 8.2302.0-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
[rsyslog-gnutls]Fixed
Source package: [rsyslog]
Details (2)
- 8.2302.0-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
- 8.2302.0-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
[rsyslog-gssapi]Fixed
Source package: [rsyslog]
Details (2)
- 8.2302.0-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
- 8.2302.0-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
[rsyslog-hiredis]Fixed
Source package: [rsyslog]
Details (2)
- 8.2302.0-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
- 8.2302.0-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
[rsyslog-kafka]Fixed
Source package: [rsyslog]
Details (2)
- 8.2302.0-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
- 8.2302.0-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
[rsyslog-kubernetes]Fixed
Source package: [rsyslog]
Details (2)
- 8.2302.0-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
- 8.2302.0-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
[rsyslog-mongodb]Fixed
Source package: [rsyslog]
Details (2)
- 8.2302.0-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
- 8.2302.0-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
[rsyslog-mysql]Fixed
Source package: [rsyslog]
Details (2)
- 8.2302.0-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
- 8.2302.0-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
[rsyslog-openssl]Fixed
Source package: [rsyslog]
Details (2)
- 8.2302.0-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
- 8.2302.0-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
[rsyslog-pgsql]Fixed
Source package: [rsyslog]
Details (2)
- 8.2302.0-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
- 8.2302.0-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
[rsyslog-relp]Fixed
Source package: [rsyslog]
Details (2)
- 8.2302.0-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
- 8.2302.0-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
[rsyslog-snmp]Fixed
Source package: [rsyslog]
Details (2)
- 8.2302.0-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12
- 8.2302.0-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · bookworm; dsa · rsyslog · debian · 12

[Debian 13 (Trixie)]

[rsyslog]Fixed
Details (2)
- 8.2504.0-1 · amd64 · trixie
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · 13
- 8.2504.0-1 · arm64 · trixie
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · 13
[rsyslog-clickhouse]Fixed
Source package: [rsyslog]
Details (2)
- 8.2504.0-1 · amd64 · trixie
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · 13
- 8.2504.0-1 · arm64 · trixie
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · 13
[rsyslog-czmq]Fixed
Source package: [rsyslog]
Details (2)
- 8.2504.0-1 · amd64 · trixie
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · 13
- 8.2504.0-1 · arm64 · trixie
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · 13
[rsyslog-docker]Fixed
Source package: [rsyslog]
Details (2)
- 8.2504.0-1 · amd64 · trixie
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · 13
- 8.2504.0-1 · arm64 · trixie
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · 13
[rsyslog-elasticsearch]Fixed
Source package: [rsyslog]
Details (2)
- 8.2504.0-1 · amd64 · trixie
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · 13
- 8.2504.0-1 · arm64 · trixie
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · 13
[rsyslog-gnutls]Fixed
Source package: [rsyslog]
Details (2)
- 8.2504.0-1 · amd64 · trixie
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · 13
- 8.2504.0-1 · arm64 · trixie
  Fixed · Fixed: 8.1910.0-1
  dsa · rsyslog · debian · 13

Next results

Observed: Oct 23, 2026, 5:41:41 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]