CVE-2024-47619

Name	CVE-2024-47619
Description	syslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo..bar` although that is not allowed. It is also possible to pass partial wildcards such as `foo.ac.bar` which glib matches but should be avoided / invalidated. This issue could have an impact on TLS connections, such as in man-in-the-middle situations. Version 4.8.2 contains a fix for the issue.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1104890

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
syslog-ng (PTS)	bullseye (security), bullseye	3.28.1-2+deb11u1	vulnerable
	bookworm	3.38.1-5	vulnerable
	trixie	4.8.1-4	vulnerable
	sid	4.8.1-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
syslog-ng	source	(unstable)	4.8.1-5			1104890

Notes

https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-xr54-gx74-fghg
https://github.com/syslog-ng/syslog-ng/issues/5360
Fixed by: https://github.com/syslog-ng/syslog-ng/commit/dadfdbecde5bfe710b0a6ee5699f96926b3f9006 (develop)