CVE catalog

CVE-2024-47619

syslog-ng: CVE-2024-47619

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published: May 7, 2025, 4:15:21 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.37% · Oct 25, 2026

syslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo.*.bar` although that is not allowed. It is also possible to pass partial wildcards such as `foo.a*c.bar` which glib matches but should be avoided / invalidated. This issue could have an impact on TLS connections, such as in man-in-the-middle situations. Version 4.8.2 contains a fix for the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	syslog-ng	sid	`4.12.0-2`	fixed
Debian	syslog-ng	forky	`4.8.1-7`	fixed
Debian	syslog-ng	trixie	`4.8.1-5+deb13u1`	fixed
Debian	syslog-ng	bookworm	`3.38.1-5+deb12u1`	fixed
Opensuse	syslog-ng	tumbleweed	`4.8.2-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	syslog-ng	source	sid	`4.8.1-5`	not yet assigned	Not reported	[1104890]
Debian	syslog-ng	source	forky	`4.8.1-5`	not yet assigned	Not reported	[1104890]
Debian	syslog-ng	source	trixie	`4.8.1-5`	not yet assigned	Not reported	[1104890]
Debian	syslog-ng	source	bookworm	`3.38.1-5+deb12u1`	not yet assigned	Not reported	[1104890]
Opensuse	syslog-ng	rpm	tumbleweed	`4.8.2-1.1`	Not reported	OPENSUSE-SU-2025:15070-1	Not reported

[Debian bug #1104890]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[libevtlog-4_12-0]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 4.8.2-1.1
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-bigquery]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 4.8.2-1.1
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-bpf]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 4.8.2-1.1
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-clickhouse]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 4.8.2-1.1
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-cloudauth]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 4.8.2-1.1
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-devel]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 4.8.2-1.1
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-geoip]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 4.8.2-1.1
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-grpc]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 4.8.2-1.1
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-http]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 4.8.2-1.1
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-loki]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 4.8.2-1.1
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-mqtt]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 4.8.2-1.1
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-opentelemetry]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 4.8.2-1.1
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-pubsub]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 4.8.2-1.1
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-python]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 4.8.2-1.1
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-python-modules]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 4.8.2-1.1
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-redis]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 4.8.2-1.1
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-smtp]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 4.8.2-1.1
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-snmp]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 4.8.2-1.1
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed
[syslog-ng-sql]Unknown
Source package: [syslog-ng]
Details (1)
- 4.12.0-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 4.8.2-1.1
  Version impact unknown
  dsa · syslog-ng · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[syslog-ng]Fixed
Details (2)
- 3.38.1-5+deb12u1 · all · bookworm
  Fixed · Fixed: 3.38.1-5+deb12u1
  dsa · syslog-ng · debian · bookworm; dsa · syslog-ng · debian · 12
- 3.38.1-5+deb12u1 · all · bookworm
  Fixed · Fixed: 3.38.1-5+deb12u1
  dsa · syslog-ng · debian · bookworm; dsa · syslog-ng · debian · 12

Next results

Observed: Oct 24, 2026, 10:35:14 PM UTC

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]