Fedora has issued an advisory on August 11: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OUMCAI6AR6Y7QYDY4WNTRCRVKY7PCM53/ The security bug is this one, which links to the upstream fix: https://bugzilla.redhat.com/show_bug.cgi?id=1582624 It was fixed upstream in 8.35.0. Mageia 5 and Mageia 6 are likely also affected.
Whiteboard: (none) => MGA6TOO
Assigning to all packagers collectively, since the registered maintainer for this package is likely still unavailable. CC'ing the registered maintainer and two recent committers,
CC: (none) => geiger.david68210, marja11, smelror, warrendiogeneseAssignee: bugsquad => pkg-bugs
No longer applicable to cauldron as it has been updated to 8.38.0 and Mageia 5 is officially EOL. Patched package uploaded for Mageia 6. Advisory: ======================== Updated rsyslogd package fixes security vulnerability: A buffer overflow was found in the SanitizeMsg() function of rsyslogd (in runtime/parser.c) which may cause a denial of service or other consequences. References: https://bugzilla.redhat.com/show_bug.cgi?id=1582624 https://github.com/rsyslog/rsyslog/commit/20f8237870eb5e971fa068e4dd4d296f1dbef329 ======================== Updated packages in core/updates_testing: ======================== rsyslog-8.16.0-1.1.mga6 rsyslog-crypto-8.16.0-1.1.mga6 rsyslog-dbi-8.16.0-1.1.mga6 rsyslog-debuginfo-8.16.0-1.1.mga6 rsyslog-elasticsearch-8.16.0-1.1.mga6 rsyslog-gnutls-8.16.0-1.1.mga6 rsyslog-gssapi-8.16.0-1.1.mga6 rsyslog-journald-8.16.0-1.1.mga6 rsyslog-mysql-8.16.0-1.1.mga6 rsyslog-pgsql-8.16.0-1.1.mga6 rsyslog-relp-8.16.0-1.1.mga6 rsyslog-snmp-8.16.0-1.1.mga6 from rsyslog-8.16.0-1.1.mga6.src.rpm Test procedure https://bugs.mageia.org/show_bug.cgi?id=14206#c2
Assignee: pkg-bugs => qa-bugsWhiteboard: MGA6TOO => (none)Version: Cauldron => 6Keywords: (none) => has_procedureCC: (none) => mrambo
Tested on Mageia 6 x86_64 ok. Advisory committed to svn. Validating the update.
Keywords: (none) => advisory, validated_updateWhiteboard: (none) => MGA6-64-OKCC: (none) => davidwhodgins, sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2018-0392.html
Status: NEW => RESOLVEDResolution: (none) => FIXED