From cd6dcc4a9e6a55353931188ed69b85d655dad729 Mon Sep 17 00:00:00 2001 From: alakatos Date: Mon, 9 May 2022 08:31:33 +0200 Subject: [PATCH 1/3] rebase to 8.2204.0 resolves: rhbz#1951970 CVE-2022-24903 rsyslog: Heap-based overflow in TCP syslog server resolves: rhbz#2082302 --- .gitignore | 2 + ...82302-CVE-heap-based-buffer-overflow.patch | 45 +++++++++++++++++++ rsyslog.spec | 12 ++++- sources | 5 +-- 4 files changed, 59 insertions(+), 5 deletions(-) create mode 100644 rsyslog-8.2204.0-rhbz2082302-CVE-heap-based-buffer-overflow.patch diff --git a/.gitignore b/.gitignore index 6f6bb6c..c2bb745 100644 --- a/.gitignore +++ b/.gitignore @@ -81,3 +81,5 @@ rsyslog-4.6.3.tar.gz /rsyslog-8.2102.0.tar.gz /rsyslog-doc-8.2102.0.tar.gz /qpid-proton-0.34.0.tar.gz +/rsyslog-8.2204.0.tar.gz +/rsyslog-doc-8.2204.0.tar.gz diff --git a/rsyslog-8.2204.0-rhbz2082302-CVE-heap-based-buffer-overflow.patch b/rsyslog-8.2204.0-rhbz2082302-CVE-heap-based-buffer-overflow.patch new file mode 100644 index 0000000..cfdfc59 --- /dev/null +++ b/rsyslog-8.2204.0-rhbz2082302-CVE-heap-based-buffer-overflow.patch @@ -0,0 +1,45 @@ +diff --git a/contrib/imhttp/imhttp.c b/contrib/imhttp/imhttp.c +index f09260b586..95704af985 100644 +--- a/contrib/imhttp/imhttp.c ++++ b/contrib/imhttp/imhttp.c +@@ -487,7 +487,9 @@ processOctetMsgLen(const instanceConf_t *const inst, struct conn_wrkr_s *connWrk + connWrkr->parseState.iOctetsRemain = connWrkr->parseState.iOctetsRemain * 10 + ch - '0'; + } + // temporarily save this character into the message buffer +- connWrkr->pMsg[connWrkr->iMsg++] = ch; ++ if(connWrkr->iMsg + 1 < s_iMaxLine) { ++ connWrkr->pMsg[connWrkr->iMsg++] = ch; ++ } + } else { + const char *remoteAddr = ""; + if (connWrkr->propRemoteAddr) { +diff --git a/plugins/imptcp/imptcp.c b/plugins/imptcp/imptcp.c +index 2df46a236c..c32dec5851 100644 +--- a/plugins/imptcp/imptcp.c ++++ b/plugins/imptcp/imptcp.c +@@ -1107,7 +1107,9 @@ processDataRcvd(ptcpsess_t *const __restrict__ pThis, + if(pThis->iOctetsRemain <= 200000000) { + pThis->iOctetsRemain = pThis->iOctetsRemain * 10 + c - '0'; + } +- *(pThis->pMsg + pThis->iMsg++) = c; ++ if(pThis->iMsg < iMaxLine) { ++ *(pThis->pMsg + pThis->iMsg++) = c; ++ } + } else { /* done with the octet count, so this must be the SP terminator */ + DBGPRINTF("TCP Message with octet-counter, size %d.\n", pThis->iOctetsRemain); + prop.GetString(pThis->peerName, &propPeerName, &lenPeerName); +diff --git a/runtime/tcps_sess.c b/runtime/tcps_sess.c +index 0efa2c23c4..c5442f7638 100644 +--- a/runtime/tcps_sess.c ++++ b/runtime/tcps_sess.c +@@ -390,7 +390,9 @@ processDataRcvd(tcps_sess_t *pThis, + if(pThis->iOctetsRemain <= 200000000) { + pThis->iOctetsRemain = pThis->iOctetsRemain * 10 + c - '0'; + } +- *(pThis->pMsg + pThis->iMsg++) = c; ++ if(pThis->iMsg < iMaxLine) { ++ *(pThis->pMsg + pThis->iMsg++) = c; ++ } + } else { /* done with the octet count, so this must be the SP terminator */ + DBGPRINTF("TCP Message with octet-counter, size %d.\n", pThis->iOctetsRemain); + prop.GetString(pThis->fromHost, &propPeerName, &lenPeerName); diff --git a/rsyslog.spec b/rsyslog.spec index 2ca0722..0c32ab5 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -7,8 +7,8 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog -Version: 8.2102.0 -Release: 10%{?dist} +Version: 8.2204.0 +Release: 1%{?dist} License: (GPLv3+ and ASL 2.0) URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -22,6 +22,7 @@ Source5: rsyslog.service Source6: qpid-proton-0.34.0.tar.gz Patch0: openssl3-compatibility.patch +Patch1: rsyslog-8.2204.0-rhbz2082302-CVE-heap-based-buffer-overflow.patch BuildRequires: make BuildRequires: gcc @@ -299,6 +300,7 @@ pushd .. %patch0 -p1 -b .openssl-compatibility popd +%patch1 -p1 -b .CVE-buffer-overflow %build %ifarch sparc64 @@ -584,6 +586,12 @@ done %changelog +* Mon May 09 2022 Attila Lakatos - 8.2204.0 +- rebase to 8.2204.0 + resolves: rhbz#1951970 +- CVE-2022-24903 rsyslog: Heap-based overflow in TCP syslog server + resolves: rhbz#2082302 + * Mon Jan 24 2022 Attila Lakatos - 8.2102.0-10 - Rebuild package with bundled qpid-proton resolves: rhbz#2042940 diff --git a/sources b/sources index f9a09d9..e6d8626 100644 --- a/sources +++ b/sources @@ -1,3 +1,2 @@ -SHA512 (rsyslog-8.2102.0.tar.gz) = 281b0e5d5cb548c39a6e514e5fd5b1bdbe8ca0bdd9234f4fea581ed7679f76d2d75b65d14c3c5e799f86f91600074ff75b467aa1ff27cdbec0f4197261c5aec0 -SHA512 (rsyslog-doc-8.2102.0.tar.gz) = a5dc4fb9bd8892fac693c5692b926c8d7d9fa36667d6b4c6eccba750713af88d4317f6232efc2a16de38c2e58c4a8bc4d04c9ebb2e7ebc3b0878d53eef20dd2e -SHA512 (qpid-proton-0.34.0.tar.gz) = 0de6c3d11baeee1d69821a0f1879a61b314f14589e02ea7ed0de8814c741217fdcafdd978b4061f73bc75588886299f4ac6808021506545ec8a883f39ad54fb3 +SHA512 (rsyslog-8.2204.0.tar.gz) = d26ab950788b8931b895719f7d8a42509f709b69a76e4188df16f72be050863ee402310ad9300840fed4ac089638497725d67433172778be7b2932fa82210472 +SHA512 (rsyslog-doc-8.2204.0.tar.gz) = 361528b95c1f02cdc2b2ca8ba5252c8215996e81ef1602e08c46be4e1fd8c1c287dd7d52ae9b2b58c0ec7fe38d7079a89e10642ac3f34fe0b6c5737968999fb4 From e46b91d71ab31d5fbd201d5efe9450930c9dc4a8 Mon Sep 17 00:00:00 2001 From: alakatos Date: Mon, 9 May 2022 09:02:35 +0200 Subject: [PATCH 2/3] Add back accidentally removed source --- rsyslog.spec | 2 +- sources | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/rsyslog.spec b/rsyslog.spec index 0c32ab5..6a6d7e4 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -586,7 +586,7 @@ done %changelog -* Mon May 09 2022 Attila Lakatos - 8.2204.0 +* Mon May 09 2022 Attila Lakatos - 8.2204.0-1 - rebase to 8.2204.0 resolves: rhbz#1951970 - CVE-2022-24903 rsyslog: Heap-based overflow in TCP syslog server diff --git a/sources b/sources index e6d8626..660b19b 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ SHA512 (rsyslog-8.2204.0.tar.gz) = d26ab950788b8931b895719f7d8a42509f709b69a76e4188df16f72be050863ee402310ad9300840fed4ac089638497725d67433172778be7b2932fa82210472 SHA512 (rsyslog-doc-8.2204.0.tar.gz) = 361528b95c1f02cdc2b2ca8ba5252c8215996e81ef1602e08c46be4e1fd8c1c287dd7d52ae9b2b58c0ec7fe38d7079a89e10642ac3f34fe0b6c5737968999fb4 +SHA512 (qpid-proton-0.34.0.tar.gz) = 0de6c3d11baeee1d69821a0f1879a61b314f14589e02ea7ed0de8814c741217fdcafdd978b4061f73bc75588886299f4ac6808021506545ec8a883f39ad54fb3 From 4790139c4c13824c38b846a795791781a0afd478 Mon Sep 17 00:00:00 2001 From: alakatos Date: Wed, 27 Jul 2022 08:27:42 +0200 Subject: [PATCH 3/3] Restore default omfile template resolves: rhbz#2088618 --- rsyslog.conf | 2 +- rsyslog.spec | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/rsyslog.conf b/rsyslog.conf index 6d45c53..f6d3f6a 100644 --- a/rsyslog.conf +++ b/rsyslog.conf @@ -12,7 +12,7 @@ global(workDirectory="/var/lib/rsyslog") #### MODULES #### # Use default timestamp format -module(load="builtin:omfile") +module(load="builtin:omfile" Template="RSYSLOG_TraditionalFileFormat") module(load="imuxsock" # provides support for local system logging (e.g. via logger command) SysSock.Use="off") # Turn off message reception via local log socket; diff --git a/rsyslog.spec b/rsyslog.spec index 6a6d7e4..0c9b426 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -8,7 +8,7 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog Version: 8.2204.0 -Release: 1%{?dist} +Release: 2%{?dist} License: (GPLv3+ and ASL 2.0) URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -586,9 +586,14 @@ done %changelog +* Wed Jul 27 2022 Attila Lakatos - 8.2204.0-2 +- Restore default omfile template + resolves: rhbz#2088618 + * Mon May 09 2022 Attila Lakatos - 8.2204.0-1 - rebase to 8.2204.0 resolves: rhbz#1951970 + - CVE-2022-24903 rsyslog: Heap-based overflow in TCP syslog server resolves: rhbz#2082302