From c69150bf60d4e2adbae0b2ac101b30efee0bfae0bfd3f7e01a9077bfc49964fe Mon Sep 17 00:00:00 2001 From: Marius Tomaschewski Date: Fri, 5 Jul 2013 08:32:43 +0000 Subject: [PATCH] - Update to 7.4.2 [v7.4-stable] (bnc#828140,CVE-2013-4758): - bugfix: in RFC5425 TLS, multiple wildcards in auth could cause segfault - bugfix: RainerScript object required parameters were not properly checked - this clould result to segfaults on startup if parameters were missing. - bugfix: double-free in omelasticsearch closes: http://bugzilla.adiscon.com/show_bug.cgi?id=461 a security advisory for this bug is available at: http://www.lsexperts.de/advisories/lse-2013-07-03.txt PLEASE NOTE: This issue only existed if omelasticsearch was used in a non-default configuration, where the "errorfile" parameter was specified. Without that parameter set, the bug could not be triggered. Thanks to Markus Vervier and Marius Ionescu for providing a detailled bug report. Special thanks to Markus for coordinating his security advisory with us. - bugfix: omrelp potential segfault at startup on invalid config parameters - bugfix: small memory leak when $uptime property was used - bugfix: potential segfault on rsyslog termination in imudp closes: http://bugzilla.adiscon.com/show_bug.cgi?id=456 - bugfix: lmsig_gt abort on invalid configuration parameters closes: http://bugzilla.adiscon.com/show_bug.cgi?id=448 Thanks to Risto Laanoja for the patch. - imtcp: fix typo in "listner" parameter, which is "listener" Currently, both names are accepted. - solved build problems on FreeBSD closes: http://bugzilla.adiscon.com/show_bug.cgi?id=457 closes: http://bugzilla.adiscon.com/show_bug.cgi?id=458 Thanks to Christiano for reproting and suggesting patches OBS-URL: https://build.opensuse.org/package/show/Base:System/rsyslog?expand=0&rev=156 --- rsyslog-7.4.1.tar.gz | 3 --- rsyslog-7.4.2.tar.gz | 3 +++ rsyslog.changes | 35 +++++++++++++++++++++++++++++++++++ rsyslog.spec | 2 +- 4 files changed, 39 insertions(+), 4 deletions(-) delete mode 100644 rsyslog-7.4.1.tar.gz create mode 100644 rsyslog-7.4.2.tar.gz diff --git a/rsyslog-7.4.1.tar.gz b/rsyslog-7.4.1.tar.gz deleted file mode 100644 index 2faf6df..0000000 --- a/rsyslog-7.4.1.tar.gz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:f890b56fc5122fabf79994e11bdefb26285e3415ba80c20f23bd3ce489098c96 -size 2902152 diff --git a/rsyslog-7.4.2.tar.gz b/rsyslog-7.4.2.tar.gz new file mode 100644 index 0000000..d179f9f --- /dev/null +++ b/rsyslog-7.4.2.tar.gz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:a78bfa8a66b353738eb08e5ec10c3b4fc6b9b8405b478515ad59b992217c6cf6 +size 2905330 diff --git a/rsyslog.changes b/rsyslog.changes index a0456d2..f41ff42 100644 --- a/rsyslog.changes +++ b/rsyslog.changes @@ -1,3 +1,38 @@ +------------------------------------------------------------------- +Fri Jul 5 08:25:02 UTC 2013 - mt@suse.de + +- Update to 7.4.2 [v7.4-stable] (bnc#828140,CVE-2013-4758): + - bugfix: in RFC5425 TLS, multiple wildcards in auth could cause + segfault + - bugfix: RainerScript object required parameters were not properly + checked - this clould result to segfaults on startup if parameters + were missing. + - bugfix: double-free in omelasticsearch + closes: http://bugzilla.adiscon.com/show_bug.cgi?id=461 + a security advisory for this bug is available at: + http://www.lsexperts.de/advisories/lse-2013-07-03.txt + PLEASE NOTE: This issue only existed if omelasticsearch was used + in a non-default configuration, where the "errorfile" parameter + was specified. Without that parameter set, the bug could not be + triggered. Thanks to Markus Vervier and Marius Ionescu for providing + a detailled bug report. Special thanks to Markus for coordinating + his security advisory with us. + - bugfix: omrelp potential segfault at startup on invalid config + parameters + - bugfix: small memory leak when $uptime property was used + - bugfix: potential segfault on rsyslog termination in imudp + closes: http://bugzilla.adiscon.com/show_bug.cgi?id=456 + - bugfix: lmsig_gt abort on invalid configuration parameters + closes: http://bugzilla.adiscon.com/show_bug.cgi?id=448 + Thanks to Risto Laanoja for the patch. + - imtcp: fix typo in "listner" parameter, which is "listener" + Currently, both names are accepted. + - solved build problems on FreeBSD + closes: http://bugzilla.adiscon.com/show_bug.cgi?id=457 + closes: http://bugzilla.adiscon.com/show_bug.cgi?id=458 + Thanks to Christiano for reproting and suggesting patches + - solved build problems on CENTOS5 + ------------------------------------------------------------------- Wed Jun 26 10:48:34 UTC 2013 - mt@suse.de diff --git a/rsyslog.spec b/rsyslog.spec index b04ee39..3e85dec 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -20,7 +20,7 @@ Name: rsyslog Summary: The enhanced syslogd for Linux and Unix License: (GPL-3.0+ and Apache-2.0) Group: System/Daemons -Version: 7.4.1 +Version: 7.4.2 Release: 0 %if 0%{?suse_version} >= 1210 %bcond_without systemd