Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:rsyslog User: [email protected] Usertags: pu
Hi, I'd like to make a stable upload for rsyslog. The changelog reads: * omfwd regression fix: avoid false active target change log message. Patch backported from upstream Git. (Closes: #1141981) * imptcp: reject invalid regex-framing recovery transitions. (CVE-2026-19654, Closes: #1144616) The patches are as minimal as possible to minimize the regression potential. CVE-2026-19654 / #1144616 was filed by the security team. We concluded to fix this via a stable upload. Regards Michael
diff --git a/debian/changelog b/debian/changelog index 4916e31e5..b57f5c82a 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,12 @@ +rsyslog (8.2504.0-1+deb13u1) trixie; urgency=medium + + * omfwd regression fix: avoid false active target change log message. + Patch backported from upstream Git. (Closes: #1141981) + * imptcp: reject invalid regex-framing recovery transitions. + (CVE-2026-19654, Closes: #1144616) + + -- Michael Biebl <[email protected]> Mon, 24 Aug 2026 15:56:02 +0200 + rsyslog (8.2504.0-1) unstable; urgency=medium * New upstream version 8.2504.0 diff --git a/debian/gbp.conf b/debian/gbp.conf index 05e704d03..3477505d6 100644 --- a/debian/gbp.conf +++ b/debian/gbp.conf @@ -1,5 +1,5 @@ [DEFAULT] pristine-tar = True patch-numbers = False -debian-branch = debian/master +debian-branch = debian/trixie upstream-branch = upstream/latest diff --git a/debian/patches/imptcp-guard-regex-framing-match-at-line-start.patch b/debian/patches/imptcp-guard-regex-framing-match-at-line-start.patch new file mode 100644 index 000000000..bb7d7b262 --- /dev/null +++ b/debian/patches/imptcp-guard-regex-framing-match-at-line-start.patch @@ -0,0 +1,44 @@ +From: Rainer Gerhards <[email protected]> +Date: Mon, 20 Jul 2026 17:19:28 +0200 +Subject: imptcp: guard regex framing match at line start + +Why +A regex match at the beginning of the receive buffer can form a +negative message length after oversize-frame recovery. + +Impact +Regex-framed imptcp listeners reject that invalid transition instead +of submitting a negative message length. + +Before/After +Before: a match with a zero line offset submitted an invalid length. +After: only a match following an existing line can submit a frame. + +Technical Overview +Mirror the line-offset guard used by the shared imtcp parser. +Leave existing regex framing and oversize recovery behavior unchanged. + +Security advisory: +https://github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7w29 + +Reported-by: Raphael Eikenberg (@eikendev) +With the help of AI-Agents: Codex + +(cherry picked from commit 07b3c40a5a78c79ed9109251f842ca7e955dd586) +--- + plugins/imptcp/imptcp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/plugins/imptcp/imptcp.c b/plugins/imptcp/imptcp.c +index 9223f20..16d2c32 100644 +--- a/plugins/imptcp/imptcp.c ++++ b/plugins/imptcp/imptcp.c +@@ -1054,7 +1054,7 @@ processDataRcvd_regexFraming(ptcpsess_t *const __restrict__ pThis, + pThis->iCurrLine = pThis->iMsg; + } else { + const int isMatch = !regexec(&inst->start_preg, (char*)pThis->pMsg+pThis->iCurrLine, 0, NULL, 0); +- if(isMatch) { ++ if (pThis->iCurrLine > 0 && isMatch) { + DBGPRINTF("regex match (%d), framing line: %s\n", pThis->iCurrLine, pThis->pMsg); + strcpy((char*)pThis->pMsg_save, (char*) pThis->pMsg+pThis->iCurrLine); + pThis->iMsg = pThis->iCurrLine - 1; diff --git a/debian/patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch b/debian/patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch new file mode 100644 index 000000000..fa12bbf88 --- /dev/null +++ b/debian/patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch @@ -0,0 +1,41 @@ +From: Rainer Gerhards <[email protected]> +Date: Sun, 8 Jun 2025 13:04:04 +0200 +Subject: omfwd regression fix: avoid false active target change log message + +Commit ffaf6dc4620da added proper variable sync, but dropped the check +if active count had actually changed. As such, the output was always +generated, which could pollute the log heavily. + +Code style fixes where dropped for the backport. + +(cherry picked from commit d6d340aaad6ea414a2fd4cf07d3f98c5c9334194) +--- + tools/omfwd.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/tools/omfwd.c b/tools/omfwd.c +index f4f1fdd..4e81461 100644 +--- a/tools/omfwd.c ++++ b/tools/omfwd.c +@@ -1146,15 +1146,17 @@ countActiveTargets(const wrkrInstanceData_t *const pWrkrData) { + oldVal = ATOMIC_FETCH_32BIT(&pWrkrData->pData->nActiveTargets, + &pWrkrData->pData->mut_nActiveTargets); + if (oldVal == activeTargets) { +- break; // No change needed ++ break; /* no change, so no log message either */ + } + newVal = activeTargets; + } while (!ATOMIC_CAS(&pWrkrData->pData->nActiveTargets, oldVal, newVal, + &pWrkrData->pData->mut_nActiveTargets)); + +- LogMsg(0, RS_RET_DEBUG, LOG_DEBUG, +- "omfwd: [wrkr %u] number of active targets changed from %d to %d", +- pWrkrData->wrkrID, oldVal, activeTargets); ++ if(oldVal != activeTargets) { ++ LogMsg(0, RS_RET_DEBUG, LOG_DEBUG, ++ "omfwd: [wrkr %u] number of active targets changed from %d to %d", ++ pWrkrData->wrkrID, oldVal, activeTargets); ++ } + } + + diff --git a/debian/patches/series b/debian/patches/series index 85d824260..103373665 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,3 +1,5 @@ Don-t-create-a-database.patch Increase-timeouts-in-imfile-basic-2GB-file-and-imfile-tru.patch Revert-queue-emit-better-warning-messages-on-queue-param-.patch +omfwd-regression-fix-avoid-false-active-target-change-log.patch +imptcp-guard-regex-framing-match-at-line-start.patch
