p PatchFirst

CVE-2008-5617

CVE-2008-5617

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The ACL handling in rsyslog 3.12.1 to 3.20.0, 4.1.0, and 4.1.1 does not follow $AllowedSender directive, which allows remote attackers to bypass intended access restrictions and spoof log messages or create a large number of spurious messages.

EPSS 2.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • rsyslog Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.18.6-1

    Update to 3.18.6-1

  • rsyslog Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.18.6-1

    Update to 3.18.6-1

  • rsyslog Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.18.6-1

    Update to 3.18.6-1

Original sources

Check your server →