CVE-2018-1000140

Name	CVE-2018-1000140
Description	rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DSA-4151-1
NVD severity	high

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
librelp (PTS)	stretch (security), stretch	1.2.12-1+deb9u1	fixed
	buster	1.3.0-1	fixed
	bookworm, sid, bullseye	1.10.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
librelp	source	wheezy	(not affected)
librelp	source	jessie	1.2.7-2+deb8u1	DSA-4151-1
librelp	source	stretch	1.2.12-1+deb9u1	DSA-4151-1
librelp	source	(unstable)	1.2.15-1

Notes

[wheezy] - librelp <not-affected> (vulnerable code not present)
https://www.rsyslog.com/cve-2018-1000140/
Fixed by: https://github.com/rsyslog/librelp/commit/2cfe657672636aa5d7d2a14cfcb0a6ab9d1f00cf