This bug was fixed in the package rsyslog - 8.2608.0-4ubuntu1
---------------
rsyslog (8.2608.0-4ubuntu1) stonking; urgency=medium
* Merge with Debian unstable (LP: #2153351). Remaining changes:
- d/00rsyslog.conf, d/rsyslog.postinst, d/rsyslog.install: add
tmpfiles.d snippet
- d/50-default.conf: set of default rules for syslog
- d/rsyslog.install: install default rules
- d/rsyslog.postrm: remove default conf file in postrm on purge,
manage with ucf
- d/rsyslog.postinst: adapt script to use ucf for Ubuntu's config
files
- d/control: add Depends for ucf
- d/rsyslog.postinst: adapt script to use ucf for Ubuntu's config
files
- d/rsyslog.conf: enable $RepeatedMsgReduction to avoid bloating the
syslog file
- d/rsyslog.conf: enable permitnonkernelfacility for non-kernel klog
messages
- d/rsyslog.conf: run as syslog:syslog, set $FileOwner to syslog
- d/usr.sbin.rsyslogd: add apparmor profile for rsyslogd
- d/rsyslog.install: install apparmor rule
- d/rules: use dh_apparmor to install profile before rsyslog is
started
- d/rsyslog.postinst: remove disabling of apparmor on upgrades
- d/rsyslog.dirs: install /etc/apparmor.d/rsyslog.d
- d/control: suggests apparmor (>= 2.3), Build-Depends on
dh-apparmor
- d/{apparmor/rsyslog-mysql, rsyslog-mysql}: add apparmor profile
for mysql plugin
- d/{apparmor/rsyslog-pgsql, rsyslog-pgsql}: add apparmor profile
for pgsql plugin
- d/{apparmor/rsyslog-gnutls, rsyslog-gnutls}: add apparmor profile
for gnutls plugin
- d/{apparmor/rsyslog-openssl, rsyslog-openssl}: add apparmor
profile for openssl plugin
- d/reload-apparmor-profile: add script to reload rsyslogd apparmor
profile
- d/rsyslog.install: install reload-apparmor-profile
- d/rsyslog.service: reload apparmor profile in ExecStartPre and set
StandardError to journal so we can see errors from the script
- d/NEWS: add info about the apparmor changes in the Ubuntu
packaging
- d/rsyslog.docs, d/README.apparmor: explains how the dynamic
component of the rsyslog apparmor profile is applied
- d/README.apparmor.syslog.d, d/rsyslog.install: install a specific
README file in the apparmor include directory for rsyslog
- d/rules: fix LDFLAGS to avoid segfault on receipt of first message
- d/rules: drop --enable-mmnormalize & --enable-pmnormalize
- d/rsyslog.install: remove mmnormalize
- d/rsyslog.postinst: create syslog uesr and add it to adm group
- d/rsyslog.postinst: adapt privileges for /var/log
- d/rsyslog.postinst: fix ownership of /var/spool/rsyslog
- d/control: add depends for adduser
- d/dmesg.service, d/rsyslog.install: provide /var/log/dmesg.log as
non log-rotated log for boot-time kernel messages
- d/clean: delete some files left over by the test suite
- d/t/utils: common test functions
- d/t/apparmor-include-mechanism: test for the rsyslog.d include
mechanism for apparmor
- d/t/simple-logger: simple logger test
- d/t/simple-mysql: test with a MySQL server
- d/t/simple-pgsql: test with a PostgreSQL server
- d/t/logcheck: fix timing of test
- d/rsyslog.logcheck.ignore.server: amend list of expected messages
to fix armhf autopkgtest (LP #2028935)
- d/rsyslog.service: adjust sandboxing; add CAP_MAC_ADMIN,
CAP_SETUID, CAP_SETGID
- d/usr.sbin.rsyslogd: add rule to allow reading systemd sessions
(LP #2056768)
- d/usr.sbin.rsyslogd: add rule to allow imjournal module to work
(LP 2073628)
- d/usr.sbin.rsyslogd: add rule to allow access to disable_ipv6
inside /proc (LP 2061726)
- d/t/logcheck: only consider current boot when checking the journal
(LP #2100765)
- d/usr.sbin.rsyslogd: allow reading of systemd-journal's dev-log
unix socket (LP #2123821)
- d/t/control: add isolation-container and skip armhf for test broken
by to mysql-server being unavailable on that arch.
- d/control, d/p/gnusort-in-tests.patch: Fix ftbfs with tests on
armhf by reverting to gnusort on tests with large data for its
memory usage. (LP #2137562)
[Refreshed the patch]
- d/rsyslog.install: usr-merge dmesg.service (LP #2139209)
- Update rsyslog apparmor profile to cope with log sockets in
chroot directories (LP #2138647):
+ d/usr.sbin.rsyslogd: add attach_disconnected flag to profile
+ d/t/{control,haproxy-logging}: new test to confirm the fix
* Dropped:
- d/p/fix-curl-ftbfs.patch: fix FTBFS with newer curl headers
(LP #2143157)
[Fixed upstream in 8.2602.0]
- SECURITY UPDATE: mmpstrucdata stack buffer overflow with oversized
RFC5424 structured data
+ debian/patches/CVE-2026-61548.patch: remove fixed-size buffer in
plugins/mmpstrucdata/mmpstrucdata.c.
+ CVE-2026-61548
[Fixed upstream in 8.2606.0]
- SECURITY UPDATE: imptcp regex-framing remote denial of service
+ debian/patches/imptcp-security.patch: Fix logic in
plugins/imptcp/imptcp.c.
+ CVE number pending
[Fixed upstream]
* Added:
- d/p/format-attribute-ftbfs.patch: add printf format attribute to
fix an FTBFS (LP: #2163685)
- d/p/openssl4-ftbfs.patch: fix openssl4 FTBFS (LP: #2163702)
- d/p/imdtls-dtlsv1-listen-openssl4.patch: fix imdtls with OpenSSL 4.0
[ Nick Rosbrook ]
* Fix for /var/log ownership conflict with the systemd package
(LP: #2158686):
- d/rsyslog.tmpfiles.conf: use ACL instead of fighting for ownership of
/var/log
- d/ryslog.postinst: do not call systemd-tmpfiles directly
rsyslog (8.2608.0-4) unstable; urgency=medium
* rainerscript: Avoid heap buffer overflow in replace() function.
Patch cherry-picked from upstream Git.
(CVE-2026-78002, Closes: #1145980)
rsyslog (8.2608.0-3) unstable; urgency=medium
* Fix debian/patches/Skip-imfile-logrotate-async.sh.patch to apply
correctly
rsyslog (8.2608.0-2) unstable; urgency=medium
* Skip imfile-logrotate-async.sh (again)
This test appears to be flaky and fails rather often on
reproducible-builds.org and reproduce.d.n.
See https://github.com/rsyslog/rsyslog/issues/6293
(Closes: #1145527)
rsyslog (8.2608.0-1) unstable; urgency=medium
* New upstream version 8.2608.0
- imptcp: reject invalid regex-framing recovery transitions
(CVE-2026-19654, Closes: #1144616)
* Rebase patches.
Drop patches that have been merged upstream.
* Enable support for Kubernetes-native log input.
Ship the new imkubernetes input module within rsyslog-kubernetes.
rsyslog (8.2606.0-4) unstable; urgency=medium
* Upload to unstable
rsyslog (8.2606.0-3) experimental; urgency=medium
* Add Build-Depends on gdb.
This hopefully provides better diagnosis if one of the tests crashes.
rsyslog (8.2606.0-2) experimental; urgency=medium
* config: keep empty include globs silent
* testbench: add daemon termination oracle
* Use check_LTLIBRARIES to generate liboverride_* test libraries
rsyslog (8.2606.0-1) experimental; urgency=medium
* New upstream version 8.2606.0
* Drop patches that have been merged upstream
* Fix doc version for sphinx-build (again)
* Enable YAML support as recommended by upstream
* Update debhelper-compat to 14
* Re-run previously skipped tests.
They are hopefully less flaky now. And if not, we want to see the
results.
rsyslog (8.2604.0-4) unstable; urgency=medium
* Fix debian/patches/Skip-imfile-logrotate-async.sh.patch to apply
correctly
rsyslog (8.2604.0-3) unstable; urgency=medium
* Revert "Run dh_auto_test with --no-parallel"
* Revert "Skip imudp_ratelimit_name and ratelimit_name test"
* ratelimit: preserve severity sentinel on unsigned char architectures
* queue: quarantine runtime disk corruption safely
rsyslog (8.2604.0-2) unstable; urgency=medium
* Skip imudp_ratelimit_name and ratelimit_name test.
Those tests fail on s390x/riscv64/ppc64el.
But they are seemingly not regressions, so skip them for now.
(Closes: #1134851)
* Bump Standards-Version to 4.7.4
rsyslog (8.2604.0-1) unstable; urgency=medium
* New upstream version 8.2604.0
rsyslog (8.2602.0-1) unstable; urgency=medium
[ Michael Biebl ]
* New upstream version 8.2602.0
* Fix doc version for sphinx-build
* Disable (new) impstats-push support.
Otherwise this would result in the main rsyslog package getting a
dependency on libcurl, libsnappy and libprotobuf-c which seems a bit
excessive. An alternative might be, to split off the impstats module
into a separate package.
* imfile: preserve symlink cleanup notifications with deferred destroy.
Patch cherry-picked from upstream Git.
https://github.com/rsyslog/rsyslog/issues/6576
[ Dennis van Dok ]
* Include README.Debian section on drop privilege specifics
rsyslog (8.2512.0-3) unstable; urgency=medium
* Bump Standards-Version to 4.7.3.
Drop Priority and Rules-Requires-Root field.
* Add explicit Build-Depends on openssl.
It is required by the test suite, so mark it as <!nocheck>.
(Closes: #1124951)
rsyslog (8.2512.0-2) unstable; urgency=medium
[ Helmut Grohne ]
* Fix FTCBFS: Demote documentation dependencies to B-D-I.
Add an explicit Build-Depends on python3-docutils for generating the man
pages. (Closes: #1123696)
[ Josselin Mouette ]
* Enable HTTP output plugin and ship it as rsyslog-http (Closes: #1121114)
rsyslog (8.2512.0-1ubuntu6) stonking; urgency=medium
* SECURITY UPDATE: imptcp regex-framing remote denial of service
- debian/patches/imptcp-security.patch: Fix logic in
plugins/imptcp/imptcp.c.
- CVE number pending
* SECURITY UPDATE: mmpstrucdata stack buffer overflow with oversized
RFC5424 structured data
- debian/patches/CVE-2026-61548.patch: remove fixed-size buffer in
plugins/mmpstrucdata/mmpstrucdata.c.
- CVE-2026-61548
-- Andreas Hasenack <[email protected]> Thu, 03 Sep 2026
15:19:49 -0300
** Changed in: rsyslog (Ubuntu)
Status: Fix Committed => Fix Released
** Bug watch added: github.com/rsyslog/rsyslog/issues #6293
https://github.com/rsyslog/rsyslog/issues/6293
** Bug watch added: github.com/rsyslog/rsyslog/issues #6576
https://github.com/rsyslog/rsyslog/issues/6576
** CVE added: https://cve.org/CVERecord?id=CVE-2026-19654
** CVE added: https://cve.org/CVERecord?id=CVE-2026-61548
** CVE added: https://cve.org/CVERecord?id=CVE-2026-78002
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2153351
Title:
FFe: Merge rsyslog from Debian for stonking cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/2153351/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
