Bug#1145980: rsyslog: CVE-2026-78002

[Michael Biebl]

Am 29.08.26 um 06:43 schrieb Salvatore Bonaccorso:

Hi Michael,

On Fri, Aug 28, 2026 at 11:10:19PM +0200, Michael Biebl wrote:

Control: notfixed -1 8.2608.0-1

Seems I missed the "="  in "<= 8.2608.0". Removing the fixed tag
accordingly.
Not surprisingly, there is no upstream fix (yet).

The fix upstream is at
https://github.com/rsyslog/rsyslog/commit/667e3f61aec5ee02c5c2ee6f0f8accf6fe4301a9
.

Regarding the question on th route for trixie, I do not think this
warrants a DSA. With the point release on 12th sepember it would be
tough great if you can batch in all open known issues for rsyslog
there?

Done.
See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1145386



Regards,
Michael

I had already uploaded a 8.2504.0-1+deb13u1 to stable-proposed-updates so made a subsequent 8.2504.0-1+deb13u2

OpenPGP_signature.asc
Description: OpenPGP digital signature