Catalogo CVE

CVE-2022-24903

rsyslog: CVE-2022-24903

[Catalogo CVE]

Gravità
High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
3.95% · Oct 22, 2026

Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability can not be used for remote code execution. But there may still be a slight chance for experts to do that. The bug occurs when the octet count is read. While there is a check for the maximum number of octets, digits are written to a heap buffer even when the octet count is over the maximum, This can be used to overrun the memory buffer. However, once the sequence of digits stop, no additional characters can be added to the buffer. In our opinion, this makes remote exploits impossible or at least highly complex. Octet-counted framing is one of two potential framing modes. It is relatively uncommon, but enabled by default on receivers. Modules `imtcp`, `imptcp`, `imgssapi`, and `imhttp` are used for regular syslog message reception. It is best practice not to directly expose them to the public. When this practice is followed, the risk is considerably lower. Module `imdiag` is a diagnostics module primarily intended for testbench runs. We do not expect it to be present on any production installation. Octet-counted framing is not very common. Usually, it needs to be specifically enabled at senders. If users do not need it, they can turn it off for the most important modules. This will mitigate the vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrsyslogsid8.2608.0-4fixed
Debianrsyslogforky8.2608.0-4fixed
Debianrsyslogtrixie8.2504.0-1+deb13u2fixed
Debianrsyslogbookworm8.2302.0-1+deb12u1fixed
Ubuntursyslogpro8.12.0-1ubuntu2vulnerable
Ubuntursyslogpro8.12.0-1ubuntu3vulnerable
Ubuntursyslogpro8.14.0-2ubuntu1vulnerable
Ubuntursyslogpro8.14.0-2ubuntu2vulnerable
Ubuntursyslogpro8.16.0-1ubuntu1vulnerable
Ubuntursyslogpro8.16.0-1ubuntu2vulnerable
Ubuntursyslogpro8.16.0-1ubuntu3vulnerable
Ubuntursyslogpro8.16.0-1ubuntu3.1vulnerable
Ubuntursyslogpro8.16.0-1ubuntu3.1+esm1vulnerable
Ubuntursyslogpro8.16.0-1ubuntu3.1+esm2fixed
Ubuntursyslog18.048.16.0-1ubuntu9vulnerable
Ubuntursyslog18.048.16.0-1ubuntu10vulnerable
Ubuntursyslog18.048.32.0-1ubuntu3vulnerable
Ubuntursyslog18.048.32.0-1ubuntu4vulnerable
Ubuntursyslog18.048.32.0-1ubuntu4.2fixed
Ubuntursyslog20.048.1901.0-1ubuntu4vulnerable
Ubuntursyslog20.048.2001.0-1ubuntu1vulnerable
Ubuntursyslog20.048.2001.0-1ubuntu1.1vulnerable
Ubuntursyslog20.048.2001.0-1ubuntu1.3fixed
Ubuntursyslog22.048.2102.0-2ubuntu2vulnerable
Ubuntursyslog22.048.2110.0-3ubuntu1vulnerable
Ubuntursyslog22.048.2110.0-3ubuntu2vulnerable
Ubuntursyslog22.048.2110.0-4ubuntu1vulnerable
Ubuntursyslog22.048.2112.0-2ubuntu2vulnerable
Ubuntursyslog22.048.2112.0-2ubuntu2.2fixed
Susersysloglinux enterprise server 12 sp58.2106.0-8.5.2fixed
Susersysloglinux enterprise server for sap applications 12 sp58.2106.0-8.5.2fixed
Opensusersyslogtumbleweed8.2204.1-1.1fixed
Susersysloglinux enterprise server 12 sp2-bcl8.4.0-18.16.1fixed
Susersysloghpe helion openstack 88.24.0-3.58.2fixed
Susersyslogopenstack cloud 88.24.0-3.58.2fixed
Susersyslogopenstack cloud 98.24.0-3.58.2fixed
Susersyslogopenstack cloud crowbar 88.24.0-3.58.2fixed
Susersyslogopenstack cloud crowbar 98.24.0-3.58.2fixed
Susersysloglinux enterprise server for sap applications 12 sp38.24.0-3.58.2fixed
Susersysloglinux enterprise server for sap applications 12 sp48.24.0-3.58.2fixed
Susersysloglinux enterprise server 12 sp3-ltss8.24.0-3.58.2fixed
Susersysloglinux enterprise server 12 sp3-bcl8.24.0-3.58.2fixed
Susersysloglinux enterprise server 12 sp4-ltss8.24.0-3.58.2fixed
Susersysloglinux enterprise high performance computing 15-espos8.33.1-150000.3.37.1fixed
Susersysloglinux enterprise high performance computing 15-ltss8.33.1-150000.3.37.1fixed
Susersysloglinux enterprise high performance computing 15 sp1-espos8.33.1-150000.3.37.1fixed
Susersysloglinux enterprise high performance computing 15 sp1-ltss8.33.1-150000.3.37.1fixed
Susersysloglinux enterprise server 15-ltss8.33.1-150000.3.37.1fixed
Susersysloglinux enterprise server 15 sp1-bcl8.33.1-150000.3.37.1fixed
Susersysloglinux enterprise server 15 sp1-ltss8.33.1-150000.3.37.1fixed
Susersysloglinux enterprise server for sap applications 158.33.1-150000.3.37.1fixed
Susersysloglinux enterprise server for sap applications 15 sp18.33.1-150000.3.37.1fixed
Susersyslogenterprise storage 68.33.1-150000.3.37.1fixed
Susersysloglinux enterprise module for basesystem 15 sp38.2106.0-150200.4.26.1fixed
Susersysloglinux enterprise module for server applications 15 sp38.2106.0-150200.4.26.1fixed
Susersysloglinux enterprise high performance computing 15 sp2-espos8.2106.0-150200.4.26.1fixed
Susersysloglinux enterprise high performance computing 15 sp2-ltss8.2106.0-150200.4.26.1fixed
Susersysloglinux enterprise real time 15 sp28.2106.0-150200.4.26.1fixed
Susersysloglinux enterprise server 15 sp2-bcl8.2106.0-150200.4.26.1fixed
Susersysloglinux enterprise server 15 sp2-ltss8.2106.0-150200.4.26.1fixed
Susersysloglinux enterprise server for sap applications 15 sp28.2106.0-150200.4.26.1fixed
Susersyslogmanager proxy 4.18.2106.0-150200.4.26.1fixed
Susersyslogmanager retail branch server 4.18.2106.0-150200.4.26.1fixed
Susersyslogmanager server 4.18.2106.0-150200.4.26.1fixed
Susersyslogenterprise storage 78.2106.0-150200.4.26.1fixed
Opensusersyslogleap 15.38.2106.0-150200.4.26.1fixed
Ubuntursyslog14.045.8.11-2ubuntu4vulnerable
Ubuntursyslog14.047.4.4-1ubuntu1vulnerable
Ubuntursyslog14.047.4.4-1ubuntu2vulnerable
Ubuntursyslog14.047.4.4-1ubuntu2.1vulnerable
Ubuntursyslog14.047.4.4-1ubuntu2.3vulnerable
Ubuntursyslog14.047.4.4-1ubuntu2.5vulnerable
Ubuntursyslog14.047.4.4-1ubuntu2.6vulnerable
Ubuntursyslog14.047.4.4-1ubuntu2.7vulnerable
Ubuntursyslogpro8.12.0-1ubuntu2vulnerable
Ubuntursyslogpro8.12.0-1ubuntu3vulnerable
Ubuntursyslogpro8.14.0-2ubuntu1vulnerable
Ubuntursyslogpro8.14.0-2ubuntu2vulnerable
Ubuntursyslogpro8.16.0-1ubuntu1vulnerable
Ubuntursyslogpro8.16.0-1ubuntu2vulnerable
Ubuntursyslogpro8.16.0-1ubuntu3vulnerable
Ubuntursyslogpro8.16.0-1ubuntu3.1vulnerable
Ubuntursyslogpro8.16.0-1ubuntu3.1+esm1vulnerable
Ubuntursyslogpro8.16.0-1ubuntu3.1+esm2fixed
Ubuntursyslog18.048.16.0-1ubuntu9vulnerable
Ubuntursyslog18.048.16.0-1ubuntu10vulnerable
Ubuntursyslog18.048.32.0-1ubuntu3vulnerable
Ubuntursyslog18.048.32.0-1ubuntu4vulnerable
Ubuntursyslog18.048.32.0-1ubuntu4.2fixed
Ubuntursyslog20.048.1901.0-1ubuntu4vulnerable
Ubuntursyslog20.048.2001.0-1ubuntu1vulnerable
Ubuntursyslog20.048.2001.0-1ubuntu1.1vulnerable
Ubuntursyslog20.048.2001.0-1ubuntu1.3fixed
Ubuntursyslog22.048.2102.0-2ubuntu2vulnerable
Ubuntursyslog22.048.2110.0-3ubuntu1vulnerable
Ubuntursyslog22.048.2110.0-3ubuntu2vulnerable
Ubuntursyslog22.048.2110.0-4ubuntu1vulnerable
Ubuntursyslog22.048.2112.0-2ubuntu2vulnerable
Ubuntursyslog22.048.2112.0-2ubuntu2.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrsyslogsourcesid8.2204.1-1not yet assignedNot reported[1010619]
Debianrsyslogsourceforky8.2204.1-1not yet assignedNot reported[1010619]
Debianrsyslogsourcetrixie8.2204.1-1not yet assignedNot reported[1010619]
Debianrsyslogsourcebookworm8.2204.1-1not yet assignedNot reported[1010619]
Ubuntursyslogdebpro8.16.0-1ubuntu3.1+esm2Not reportedUSN-5404-2Not reported
Ubuntursyslogdeb18.048.32.0-1ubuntu4.2Not reportedUSN-5404-1Not reported
Ubuntursyslogdeb20.048.2001.0-1ubuntu1.3Not reportedUSN-5404-1Not reported
Ubuntursyslogdeb22.048.2112.0-2ubuntu2.2Not reportedUSN-5404-1Not reported
Susersyslogrpmlinux enterprise server 12 sp58.2106.0-8.5.2Not reportedSUSE-SU-2022:2314-1Not reported
Susersyslogrpmlinux enterprise server for sap applications 12 sp58.2106.0-8.5.2Not reportedSUSE-SU-2022:2314-1Not reported
Opensusersyslogrpmtumbleweed8.2204.1-1.1Not reportedOPENSUSE-SU-2024:12059-1Not reported
Susersyslogrpmlinux enterprise server 12 sp2-bcl8.4.0-18.16.1Not reportedSUSE-SU-2022:2333-1Not reported
Susersyslogrpmhpe helion openstack 88.24.0-3.58.2Not reportedSUSE-SU-2022:2331-1Not reported
Susersyslogrpmopenstack cloud 88.24.0-3.58.2Not reportedSUSE-SU-2022:2331-1Not reported
Susersyslogrpmopenstack cloud 98.24.0-3.58.2Not reportedSUSE-SU-2022:2331-1Not reported
Susersyslogrpmopenstack cloud crowbar 88.24.0-3.58.2Not reportedSUSE-SU-2022:2331-1Not reported
Susersyslogrpmopenstack cloud crowbar 98.24.0-3.58.2Not reportedSUSE-SU-2022:2331-1Not reported
Susersyslogrpmlinux enterprise server for sap applications 12 sp38.24.0-3.58.2Not reportedSUSE-SU-2022:2331-1Not reported
Susersyslogrpmlinux enterprise server for sap applications 12 sp48.24.0-3.58.2Not reportedSUSE-SU-2022:2331-1Not reported
Susersyslogrpmlinux enterprise server 12 sp3-ltss8.24.0-3.58.2Not reportedSUSE-SU-2022:2331-1Not reported
Susersyslogrpmlinux enterprise server 12 sp3-bcl8.24.0-3.58.2Not reportedSUSE-SU-2022:2331-1Not reported
Susersyslogrpmlinux enterprise server 12 sp4-ltss8.24.0-3.58.2Not reportedSUSE-SU-2022:2331-1Not reported
Susersyslogrpmlinux enterprise high performance computing 15-espos8.33.1-150000.3.37.1Not reportedSUSE-SU-2022:1817-1Not reported
Susersyslogrpmlinux enterprise high performance computing 15-ltss8.33.1-150000.3.37.1Not reportedSUSE-SU-2022:1817-1Not reported
Susersyslogrpmlinux enterprise high performance computing 15 sp1-espos8.33.1-150000.3.37.1Not reportedSUSE-SU-2022:1817-1Not reported
Susersyslogrpmlinux enterprise high performance computing 15 sp1-ltss8.33.1-150000.3.37.1Not reportedSUSE-SU-2022:1817-1Not reported
Susersyslogrpmlinux enterprise server 15-ltss8.33.1-150000.3.37.1Not reportedSUSE-SU-2022:1817-1Not reported
Susersyslogrpmlinux enterprise server 15 sp1-bcl8.33.1-150000.3.37.1Not reportedSUSE-SU-2022:1817-1Not reported
Susersyslogrpmlinux enterprise server 15 sp1-ltss8.33.1-150000.3.37.1Not reportedSUSE-SU-2022:1817-1Not reported
Susersyslogrpmlinux enterprise server for sap applications 158.33.1-150000.3.37.1Not reportedSUSE-SU-2022:1817-1Not reported
Susersyslogrpmlinux enterprise server for sap applications 15 sp18.33.1-150000.3.37.1Not reportedSUSE-SU-2022:1817-1Not reported
Susersyslogrpmenterprise storage 68.33.1-150000.3.37.1Not reportedSUSE-SU-2022:1817-1Not reported
Susersyslogrpmlinux enterprise module for basesystem 15 sp38.2106.0-150200.4.26.1Not reportedSUSE-SU-2022:1583-1Not reported
Susersyslogrpmlinux enterprise module for server applications 15 sp38.2106.0-150200.4.26.1Not reportedSUSE-SU-2022:1583-1Not reported
Susersyslogrpmlinux enterprise high performance computing 15 sp2-espos8.2106.0-150200.4.26.1Not reportedSUSE-SU-2022:1583-1Not reported
Susersyslogrpmlinux enterprise high performance computing 15 sp2-ltss8.2106.0-150200.4.26.1Not reportedSUSE-SU-2022:1583-1Not reported
Susersyslogrpmlinux enterprise real time 15 sp28.2106.0-150200.4.26.1Not reportedSUSE-SU-2022:1583-1Not reported
Susersyslogrpmlinux enterprise server 15 sp2-bcl8.2106.0-150200.4.26.1Not reportedSUSE-SU-2022:1583-1Not reported
Susersyslogrpmlinux enterprise server 15 sp2-ltss8.2106.0-150200.4.26.1Not reportedSUSE-SU-2022:1583-1Not reported
Susersyslogrpmlinux enterprise server for sap applications 15 sp28.2106.0-150200.4.26.1Not reportedSUSE-SU-2022:1583-1Not reported
Susersyslogrpmmanager proxy 4.18.2106.0-150200.4.26.1Not reportedSUSE-SU-2022:1583-1Not reported
Susersyslogrpmmanager retail branch server 4.18.2106.0-150200.4.26.1Not reportedSUSE-SU-2022:1583-1Not reported
Susersyslogrpmmanager server 4.18.2106.0-150200.4.26.1Not reportedSUSE-SU-2022:1583-1Not reported
Susersyslogrpmenterprise storage 78.2106.0-150200.4.26.1Not reportedSUSE-SU-2022:1583-1Not reported
Opensusersyslogrpmleap 15.38.2106.0-150200.4.26.1Not reportedSUSE-SU-2022:1583-1Not reported
Ubuntursyslogdebpro8.16.0-1ubuntu3.1+esm2Not reportedUBUNTU-CVE-2022-24903Not reported
Ubuntursyslogdeb18.048.32.0-1ubuntu4.2Not reportedUBUNTU-CVE-2022-24903Not reported
Ubuntursyslogdeb20.048.2001.0-1ubuntu1.3Not reportedUBUNTU-CVE-2022-24903Not reported
Ubuntursyslogdeb22.048.2112.0-2ubuntu2.2Not reportedUBUNTU-CVE-2022-24903Not reported

[Debian bug #1010619]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [rsyslog-devel]Sconosciuto

    Pacchetto sorgente: [rsyslog]

    Dettagli (1)
    • 8.2606.0-3.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 8.2204.1-1.1

      Version impact unknown

      dsa · rsyslog · opensuse · tumbleweed

  • [rsyslog-diag-tools]Sconosciuto

    Pacchetto sorgente: [rsyslog]

    Dettagli (1)
    • 8.2606.0-3.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 8.2204.1-1.1

      Version impact unknown

      dsa · rsyslog · opensuse · tumbleweed

  • [rsyslog-doc]Sconosciuto

    Pacchetto sorgente: [rsyslog]

    Dettagli (1)
    • 8.2606.0-3.1 · noarch · tumbleweed

      Sconosciuto · Corretta: 8.2204.1-1.1

      Version impact unknown

      dsa · rsyslog · opensuse · tumbleweed

  • [rsyslog-module-dtls]Sconosciuto

    Pacchetto sorgente: [rsyslog]

    Dettagli (1)
    • 8.2606.0-3.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 8.2204.1-1.1

      Version impact unknown

      dsa · rsyslog · opensuse · tumbleweed

  • Pacchetto sorgente: [rsyslog]

    Dettagli (1)
    • 8.2606.0-3.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 8.2204.1-1.1

      Version impact unknown

      dsa · rsyslog · opensuse · tumbleweed

  • Pacchetto sorgente: [rsyslog]

    Dettagli (1)
    • 8.2606.0-3.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 8.2204.1-1.1

      Version impact unknown

      dsa · rsyslog · opensuse · tumbleweed

  • Pacchetto sorgente: [rsyslog]

    Dettagli (1)
    • 8.2606.0-3.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 8.2204.1-1.1

      Version impact unknown

      dsa · rsyslog · opensuse · tumbleweed

  • [rsyslog-module-gtls]Sconosciuto

    Pacchetto sorgente: [rsyslog]

    Dettagli (1)
    • 8.2606.0-3.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 8.2204.1-1.1

      Version impact unknown

      dsa · rsyslog · opensuse · tumbleweed

  • Pacchetto sorgente: [rsyslog]

    Dettagli (1)
    • 8.2606.0-3.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 8.2204.1-1.1

      Version impact unknown

      dsa · rsyslog · opensuse · tumbleweed

  • Pacchetto sorgente: [rsyslog]

    Dettagli (1)
    • 8.2606.0-3.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 8.2204.1-1.1

      Version impact unknown

      dsa · rsyslog · opensuse · tumbleweed

  • Pacchetto sorgente: [rsyslog]

    Dettagli (1)
    • 8.2606.0-3.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 8.2204.1-1.1

      Version impact unknown

      dsa · rsyslog · opensuse · tumbleweed

  • Pacchetto sorgente: [rsyslog]

    Dettagli (1)
    • 8.2606.0-3.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 8.2204.1-1.1

      Version impact unknown

      dsa · rsyslog · opensuse · tumbleweed

  • Pacchetto sorgente: [rsyslog]

    Dettagli (1)
    • 8.2606.0-3.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 8.2204.1-1.1

      Version impact unknown

      dsa · rsyslog · opensuse · tumbleweed

  • Pacchetto sorgente: [rsyslog]

    Dettagli (1)
    • 8.2606.0-3.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 8.2204.1-1.1

      Version impact unknown

      dsa · rsyslog · opensuse · tumbleweed

  • [rsyslog-module-ossl]Sconosciuto

    Pacchetto sorgente: [rsyslog]

    Dettagli (1)
    • 8.2606.0-3.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 8.2204.1-1.1

      Version impact unknown

      dsa · rsyslog · opensuse · tumbleweed

  • Pacchetto sorgente: [rsyslog]

    Dettagli (1)
    • 8.2606.0-3.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 8.2204.1-1.1

      Version impact unknown

      dsa · rsyslog · opensuse · tumbleweed

  • [rsyslog-module-relp]Sconosciuto

    Pacchetto sorgente: [rsyslog]

    Dettagli (1)
    • 8.2606.0-3.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 8.2204.1-1.1

      Version impact unknown

      dsa · rsyslog · opensuse · tumbleweed

  • [rsyslog-module-snmp]Sconosciuto

    Pacchetto sorgente: [rsyslog]

    Dettagli (1)
    • 8.2606.0-3.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 8.2204.1-1.1

      Version impact unknown

      dsa · rsyslog · opensuse · tumbleweed

  • Pacchetto sorgente: [rsyslog]

    Dettagli (1)
    • 8.2606.0-3.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 8.2204.1-1.1

      Version impact unknown

      dsa · rsyslog · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [rsyslog]Corretta
    Dettagli (2)
    • 8.2302.0-1+deb12u1 · amd64 · bookworm

      Corretta · Corretta: 8.2204.1-1

      dsa · rsyslog · debian · bookworm

    • 8.2302.0-1+deb12u1 · arm64 · bookworm

      Corretta · Corretta: 8.2204.1-1

      dsa · rsyslog · debian · bookworm

Altri risultati

Osservato:

Riferimenti