Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package rsyslog for openSUSE:Factory checked in at 2026-07-26 11:27:29 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/rsyslog (Old) and /work/SRC/openSUSE:Factory/.rsyslog.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rsyslog" Sun Jul 26 11:27:29 2026 rev:188 rq:1367312 version:8.2502.0 Changes: -------- --- /work/SRC/openSUSE:Factory/rsyslog/rsyslog.changes 2026-07-21 22:56:13.057119166 +0200 +++ /work/SRC/openSUSE:Factory/.rsyslog.new.2004/rsyslog.changes 2026-07-26 11:28:31.542809986 +0200 @@ -1,0 +2,6 @@ +Thu Jul 23 06:47:30 UTC 2026 - Thomas Blume <[email protected]> + +- fix imptcp regex-framing remote denial of service (bsc#1271910) + * add 0001-imptcp-guard-regex-framing-match-at-line-start.patch + +------------------------------------------------------------------- New: ---- 0001-imptcp-guard-regex-framing-match-at-line-start.patch ----------(New B)---------- New:- fix imptcp regex-framing remote denial of service (bsc#1271910) * add 0001-imptcp-guard-regex-framing-match-at-line-start.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ rsyslog.spec ++++++ --- /var/tmp/diff_new_pack.YbS81L/_old 2026-07-26 11:28:34.222901880 +0200 +++ /var/tmp/diff_new_pack.YbS81L/_new 2026-07-26 11:28:34.246902703 +0200 @@ -222,6 +222,8 @@ Source19: NetworkManager.frule Source20: rsyslog-tmpfiles.conf +Patch0: 0001-imptcp-guard-regex-framing-match-at-line-start.patch + # this is a dirty hack since % dir does only work for the specified directory and nothing above # but I want to be able to switch this to /etc/apparmor.d once the profiles received more testing %define APPARMOR_PROFILE_PATH /usr/share/apparmor/extra-profiles ++++++ 0001-imptcp-guard-regex-framing-match-at-line-start.patch ++++++ >From 9ef6c7c11f2555f4766b822983f8f49f44df0349 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards <[email protected]> Date: Mon, 20 Jul 2026 17:19:28 +0200 Subject: [PATCH] imptcp: guard regex framing match at line start Why A regex match at the beginning of the receive buffer can form a negative message length after oversize-frame recovery. Impact Regex-framed imptcp listeners reject that invalid transition instead of submitting a negative message length. Before/After Before: a match with a zero line offset submitted an invalid length. After: only a match following an existing line can submit a frame. Technical Overview Mirror the line-offset guard used by the shared imtcp parser. Leave existing regex framing and oversize recovery behavior unchanged. Security advisory: https://github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7w29 Reported-by: Raphael Eikenberg (@eikendev) With the help of AI-Agents: Codex (cherry picked from commit 07b3c40a5a78c79ed9109251f842ca7e955dd586) --- plugins/imptcp/imptcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/imptcp/imptcp.c b/plugins/imptcp/imptcp.c index 9223f20d0..16d2c327b 100644 --- a/plugins/imptcp/imptcp.c +++ b/plugins/imptcp/imptcp.c @@ -1054,7 +1054,7 @@ processDataRcvd_regexFraming(ptcpsess_t *const __restrict__ pThis, pThis->iCurrLine = pThis->iMsg; } else { const int isMatch = !regexec(&inst->start_preg, (char*)pThis->pMsg+pThis->iCurrLine, 0, NULL, 0); - if(isMatch) { + if (pThis->iCurrLine > 0 && isMatch) { DBGPRINTF("regex match (%d), framing line: %s\n", pThis->iCurrLine, pThis->pMsg); strcpy((char*)pThis->pMsg_save, (char*) pThis->pMsg+pThis->iCurrLine); pThis->iMsg = pThis->iCurrLine - 1; -- 2.55.0
