Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package rsyslog for openSUSE:Factory checked in at 2026-09-28 10:35:01 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/rsyslog (Old) and /work/SRC/openSUSE:Factory/.rsyslog.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rsyslog" Mon Sep 28 10:35:01 2026 rev:193 rq:1380097 version:8.2608.0 Changes: -------- --- /work/SRC/openSUSE:Factory/rsyslog/rsyslog.changes 2026-09-07 11:30:02.007477372 +0200 +++ /work/SRC/openSUSE:Factory/.rsyslog.new.383539/rsyslog.changes 2026-09-28 10:35:17.568904937 +0200 @@ -1,0 +2,6 @@ +Wed Sep 23 13:22:56 UTC 2026 - Thomas Blume <[email protected]> + +- fix VUL-0: imdtls permitted-peer authorization bypass (bsc#1281628) + * add 0001-imdtls-reject-clients-that-fail-peer-verification.patch + +------------------------------------------------------------------- New: ---- 0001-imdtls-reject-clients-that-fail-peer-verification.patch ----------(New B)---------- New:- fix VUL-0: imdtls permitted-peer authorization bypass (bsc#1281628) * add 0001-imdtls-reject-clients-that-fail-peer-verification.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ rsyslog.spec ++++++ --- /var/tmp/diff_new_pack.CIEOfx/_old 2026-09-28 10:35:18.502944088 +0200 +++ /var/tmp/diff_new_pack.CIEOfx/_new 2026-09-28 10:35:18.504944172 +0200 @@ -236,7 +236,8 @@ Source18: firewall.frule Source19: NetworkManager.frule Source20: rsyslog-tmpfiles.conf -Patch: 0001-fix-RainerScript-replace-heap-buffer-overflow.patch +Patch1: 0001-fix-RainerScript-replace-heap-buffer-overflow.patch +Patch2: 0001-imdtls-reject-clients-that-fail-peer-verification.patch # this is a dirty hack since % dir does only work for the specified directory and nothing above # but I want to be able to switch this to /etc/apparmor.d once the profiles received more testing ++++++ 0001-imdtls-reject-clients-that-fail-peer-verification.patch ++++++ >From ef9f77d709640ceb3d5e78118081a291f9e373c5 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards <[email protected]> Date: Tue, 25 Aug 2026 18:15:20 +0200 Subject: [PATCH] imdtls: reject clients that fail peer verification --- plugins/imdtls/imdtls.c | 1 + 1 file changed, 1 insertion(+) diff --git a/plugins/imdtls/imdtls.c b/plugins/imdtls/imdtls.c index 6e4a405bb..055091662 100644 --- a/plugins/imdtls/imdtls.c +++ b/plugins/imdtls/imdtls.c @@ -592,6 +592,7 @@ static void DTLSAcceptSession(instanceConf_t *inst, int idx) { status = imdtls_verify_callback(status, ssl); if (status == 0) { LogMsg(0, RS_RET_NO_ERRCODE, LOG_WARNING, "imdtls: Cert Verify FAILED for DTLS client idx (%d)", idx); + DTLScleanupSession(inst, idx); } else { DBGPRINTF("imdtls: Cert Verify SUCCESS for DTLS client idx (%d)\n", idx); } -- 2.55.0
