An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function. syslog-ng Premium Edition 7.0.30 and syslog-ng Store Box 6.10.0 are also affected.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
|
| References | () https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-7932-4fc6-pvmc - Third Party Advisory | |
| References | () https://lists.balabit.hu/pipermail/syslog-ng/ - Third Party Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2023/02/msg00043.html - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3TZ7U2GQTAHVHJXSSEHQS5D2Q5T6SZB/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QU36HCM3VZYANUYFC6XFYEYJEKQPA2Q7/ - | |
| References | () https://security.gentoo.org/glsa/202305-09 - | |
| References | () https://www.debian.org/security/2023/dsa-5369 - |
03 May 2023, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
06 Mar 2023, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
01 Mar 2023, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-01-23 16:15
Updated : 2024-11-21 07:16
NVD link : CVE-2022-38725
Mitre link : CVE-2022-38725
CVE.ORG link : CVE-2022-38725
JSON object : View
Products Affected
oneidentity
- syslog-ng
- syslog-ng_store_box
CWE
CWE-190
Integer Overflow or Wraparound