oss-sec mailing list archives
Re: vulnerability in rsyslog
From: Rainer Gerhards <rgerhards () hq adiscon com>
Date: Mon, 6 Oct 2014 09:34:39 +0200
2014-10-06 9:12 GMT+02:00 Sven Kieske <s.kieske () mittwald de>:
On 06/10/14 08:40, Rainer Gerhards wrote:2014-10-06 8:31 GMT+02:00 Sven Kieske <s.kieske () mittwald de>:On 30/09/14 18:41, Rainer Gerhards wrote:2014-09-30 18:28 GMT+02:00 Solar Designer <solar () openwall com>:On Tue, Sep 30, 2014 at 01:55:12PM +0200, Sven Kieske wrote:I don't understand the following statement in the pri-vuln.txt in section "Patches": "Version 7.4.6, while no longer being project supported received a patch and is also not vulnerable." What was patched when this version is not vulnerable? Or do you mean it is not vulnerable after the patch got applied?My apologies, this is a type that skipped past all proof-reading. Itshouldsay "7.6.6", which is the v7 version released today. v7.4.x is not only non-project supported, it's also heavily outdated and missing manyotherpatches as well (just to point this out).This still does not answer the above questions, it just changes the version number in your statement which led to my question.you can view the complete patch set here: https://github.com/rsyslog/rsyslog/commits/v7-stableThis web page does list all commits to v7-stable. So I think you want me to dig through the code to find the answer to my question? I knew I could answer my question by going through the code, but I figured it would be easier to ask someone who is already familiar with it. It turned out I was wrong.
Sorry, it looks like I don't understand your question. 7.6.6 (7.6.7 today) has no special patch file, because the version itself did receive the necessary patches. If you'd like to see exactly which code was changed you can also look at the totally-dead-version patches available here: http://www.rsyslog.com/files/download/rsyslog/CVE-2014-3683-pri-vuln.tar.gz If you prefer, I can also do a $ git diff v7.6.5 v7.6.6 for you and post the result. HTH Rainer
Current thread:
- Re: vulnerability in rsyslog Sven Kieske (Oct 05)
- Re: vulnerability in rsyslog Rainer Gerhards (Oct 05)
- Re: vulnerability in rsyslog Sven Kieske (Oct 06)
- Re: vulnerability in rsyslog Rainer Gerhards (Oct 06)
- Re: vulnerability in rsyslog Simon McVittie (Oct 06)
- Re: vulnerability in rsyslog Rainer Gerhards (Oct 06)
- Re: vulnerability in rsyslog John Haxby (Oct 06)
- Re: vulnerability in rsyslog Sven Kieske (Oct 06)
- Re: vulnerability in rsyslog Rainer Gerhards (Oct 05)