diff --git a/.gitignore b/.gitignore
index c93e2fc..e39ba7f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -80,3 +80,6 @@ rsyslog-4.6.3.tar.gz
 /qpid-proton-0.31.0.tar.gz
 /rsyslog-8.2102.0.tar.gz
 /rsyslog-doc-8.2102.0.tar.gz
+/rsyslog-8.2204.0.tar.gz
+/rsyslog-doc-8.2204.0.tar.gz
+/qpid-proton-0.34.0.tar.gz
diff --git a/rsyslog-8.2204.0-rhbz2082302-CVE-heap-based-buffer-overflow.patch b/rsyslog-8.2204.0-rhbz2082302-CVE-heap-based-buffer-overflow.patch
new file mode 100644
index 0000000..cfdfc59
--- /dev/null
+++ b/rsyslog-8.2204.0-rhbz2082302-CVE-heap-based-buffer-overflow.patch
@@ -0,0 +1,45 @@
+diff --git a/contrib/imhttp/imhttp.c b/contrib/imhttp/imhttp.c
+index f09260b586..95704af985 100644
+--- a/contrib/imhttp/imhttp.c
++++ b/contrib/imhttp/imhttp.c
+@@ -487,7 +487,9 @@ processOctetMsgLen(const instanceConf_t *const inst, struct conn_wrkr_s *connWrk
+ 				connWrkr->parseState.iOctetsRemain = connWrkr->parseState.iOctetsRemain * 10 + ch - '0';
+ 			}
+ 			// temporarily save this character into the message buffer
+-			connWrkr->pMsg[connWrkr->iMsg++] = ch;
++			if(connWrkr->iMsg + 1 < s_iMaxLine) {
++				connWrkr->pMsg[connWrkr->iMsg++] = ch;
++			}
+ 		} else {
+ 			const char *remoteAddr = "";
+ 			if (connWrkr->propRemoteAddr) {
+diff --git a/plugins/imptcp/imptcp.c b/plugins/imptcp/imptcp.c
+index 2df46a236c..c32dec5851 100644
+--- a/plugins/imptcp/imptcp.c
++++ b/plugins/imptcp/imptcp.c
+@@ -1107,7 +1107,9 @@ processDataRcvd(ptcpsess_t *const __restrict__ pThis,
+ 			if(pThis->iOctetsRemain <= 200000000) {
+ 				pThis->iOctetsRemain = pThis->iOctetsRemain * 10 + c - '0';
+ 			}
+-			*(pThis->pMsg + pThis->iMsg++) = c;
++			if(pThis->iMsg < iMaxLine) {
++				*(pThis->pMsg + pThis->iMsg++) = c;
++			}
+ 		} else { /* done with the octet count, so this must be the SP terminator */
+ 			DBGPRINTF("TCP Message with octet-counter, size %d.\n", pThis->iOctetsRemain);
+ 			prop.GetString(pThis->peerName, &propPeerName, &lenPeerName);
+diff --git a/runtime/tcps_sess.c b/runtime/tcps_sess.c
+index 0efa2c23c4..c5442f7638 100644
+--- a/runtime/tcps_sess.c
++++ b/runtime/tcps_sess.c
+@@ -390,7 +390,9 @@ processDataRcvd(tcps_sess_t *pThis,
+ 			if(pThis->iOctetsRemain <= 200000000) {
+ 				pThis->iOctetsRemain = pThis->iOctetsRemain * 10 + c - '0';
+ 			}
+-			*(pThis->pMsg + pThis->iMsg++) = c;
++			if(pThis->iMsg < iMaxLine) {
++				*(pThis->pMsg + pThis->iMsg++) = c;
++			}
+ 		} else { /* done with the octet count, so this must be the SP terminator */
+ 			DBGPRINTF("TCP Message with octet-counter, size %d.\n", pThis->iOctetsRemain);
+ 			prop.GetString(pThis->fromHost, &propPeerName, &lenPeerName);
diff --git a/rsyslog.spec b/rsyslog.spec
index ba6eb36..87ff34d 100644
--- a/rsyslog.spec
+++ b/rsyslog.spec
@@ -7,8 +7,8 @@
 
 Summary: Enhanced system logging and kernel message trapping daemon
 Name: rsyslog
-Version: 8.2102.0
-Release: 4%{?dist}
+Version: 8.2204.0
+Release: 2%{?dist}
 License: (GPLv3+ and ASL 2.0)
 URL: http://www.rsyslog.com/
 Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz
@@ -17,6 +17,9 @@ Source2: rsyslog.conf
 Source3: rsyslog.sysconfig
 Source4: rsyslog.log
 Source5: rsyslog.service
+
+Patch0: rsyslog-8.2204.0-rhbz2082302-CVE-heap-based-buffer-overflow.patch
+
 # Add qpid-proton as another source, enable omamqp1 module in a
 # separatae sub-package with it statically linked(see rhbz#1713427)
 %if 0%{?rhel} != 0
@@ -42,7 +45,9 @@ BuildRequires: python3-docutils
 # make sure systemd is in a version that isn't affected by rhbz#974132
 BuildRequires: systemd-devel >= 204-8
 BuildRequires: zlib-devel
+BuildRequires: openssl-devel
 
+Requires: openssl-libs
 Requires: logrotate >= 3.5.2
 Requires: bash >= 2.0
 %{?systemd_ordering}
@@ -101,10 +106,16 @@ Requires: %name = %version-%release
 BuildRequires: librelp-devel >= 1.2.16
 
 %package gnutls
-Summary: TLS protocol support for rsyslog
+Summary: TLS protocol support for rsyslog via GnuTLS library
 Requires: %name = %version-%release
 BuildRequires: gnutls-devel
 
+%package openssl
+Summary: TLS protocol support for rsyslog via OpenSSL library
+Group: System Environment/Daemons
+Requires: %name = %version-%release
+BuildRequires: openssl-devel
+
 %package snmp
 Summary: SNMP protocol support for rsyslog
 Requires: %name = %version-%release
@@ -219,8 +230,15 @@ protocol.
 
 %description gnutls
 The rsyslog-gnutls package contains the rsyslog plugins that provide the
-ability to receive syslog messages via upcoming syslog-transport-tls
-IETF standard protocol.
+ability to send and receive syslog messages via TCP or RELP using TLS
+encryption via GnuTLS library. For details refer to rsyslog doc on imtcp
+and omfwd modules.
+
+%description openssl
+The rsyslog-openssl package contains the rsyslog plugins that provide the
+ability to send and receive syslog messages via TCP or RELP using TLS
+encryption via OpenSSL library. For details refer to rsyslog doc on imtcp
+and omfwd modules.
 
 %description snmp
 The rsyslog-snmp package contains the rsyslog plugin that provides the
@@ -271,6 +289,8 @@ mv build doc
 %setup -q -D -T -b 6
 %endif
 
+%patch0 -p1 -b .CVE-buffer-overflow
+
 %build
 %if 0%{?rhel} != 0
 %ifarch sparc64
@@ -333,6 +353,7 @@ autoreconf -if
 	--enable-elasticsearch \
 	--enable-generate-man-pages \
 	--enable-gnutls \
+	--enable-openssl \
 	--enable-gssapi-krb5 \
 	--enable-imfile \
 	--enable-imjournal \
@@ -515,6 +536,9 @@ done
 %files gnutls
 %{_libdir}/rsyslog/lmnsd_gtls.so
 
+%files openssl
+%{_libdir}/rsyslog/lmnsd_ossl.so
+
 %files snmp
 %{_libdir}/rsyslog/omsnmp.so
 
@@ -550,6 +574,22 @@ done
 
 
 %changelog
+* Wed Jul 27 2022 Attila Lakatos <alakatos@redhat.com> - 8.2204.0-2
+- Restore default omfile template
+  resolves: rhbz#2088618
+
+* Mon May 09 2022 Attila Lakatos <alakatos@redhat.com> - 8.2204.0-1
+- rebase to 8.2204.0
+  resolves: rhbz#1951970
+
+- CVE-2022-24903 rsyslog: Heap-based overflow in TCP syslog server
+  resolves: rhbz#2082302
+
+* Wed Aug 25 2021 Attila Lakatos <alakatos@redhat.com> - 8.2102.0-5
+- Enable openssl
+- Do not set default template for omfile
+  resolves: rhbz#1985195
+
 * Tue Jul 27 2021 Pavel Raiskup <praiskup@redhat.com> - 8.2102.0-4
 - reorder the rsyslog.conf to simplify the rsyslog.d configuration (#1985202)
 
diff --git a/sources b/sources
index ccff29d..660b19b 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (qpid-proton-0.31.0.tar.gz) = 39487c34ae6ae1cc0c2f57f2ffb2bdf48a554e9ba8439a5c3f9776205cdb138f71284c9fc7626e4bbee3110ccce7da61ddb45f51ebddfede981ada0872074202
-SHA512 (rsyslog-8.2102.0.tar.gz) = 281b0e5d5cb548c39a6e514e5fd5b1bdbe8ca0bdd9234f4fea581ed7679f76d2d75b65d14c3c5e799f86f91600074ff75b467aa1ff27cdbec0f4197261c5aec0
-SHA512 (rsyslog-doc-8.2102.0.tar.gz) = a5dc4fb9bd8892fac693c5692b926c8d7d9fa36667d6b4c6eccba750713af88d4317f6232efc2a16de38c2e58c4a8bc4d04c9ebb2e7ebc3b0878d53eef20dd2e
+SHA512 (rsyslog-8.2204.0.tar.gz) = d26ab950788b8931b895719f7d8a42509f709b69a76e4188df16f72be050863ee402310ad9300840fed4ac089638497725d67433172778be7b2932fa82210472
+SHA512 (rsyslog-doc-8.2204.0.tar.gz) = 361528b95c1f02cdc2b2ca8ba5252c8215996e81ef1602e08c46be4e1fd8c1c287dd7d52ae9b2b58c0ec7fe38d7079a89e10642ac3f34fe0b6c5737968999fb4
+SHA512 (qpid-proton-0.34.0.tar.gz) = 0de6c3d11baeee1d69821a0f1879a61b314f14589e02ea7ed0de8814c741217fdcafdd978b4061f73bc75588886299f4ac6808021506545ec8a883f39ad54fb3