PT-2013-5177 · Elastic+2 · Elasticsearch+2

Marius Ionescu + 1 · Publicado 2013-10-04 · Atualizado 2024-06-15 · CVE-2013-4758

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions rsyslog versions prior to 7.4.2 rsyslog versions prior to 7.5.2 devel

Description The issue is related to a double free vulnerability in the writeDataError function within the ElasticSearch plugin (omelasticsearch) of rsyslog. This vulnerability can be exploited by remote attackers when the errorfile is set to local logging, allowing them to cause a denial of service (crash) and potentially execute arbitrary code via a crafted JSON response.

Recommendations For versions prior to 7.4.2, update to version 7.4.2 or later. For versions prior to 7.5.2 devel, update to version 7.5.2 devel or later.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

ALT-PU-2014-1540

CVE-2013-4758

OPENSUSE-SU-2024:10498-1

Produtos afetados

Alt Linux

Elasticsearch

Rsyslog

Referências · 14

• https://packages.altlinux.org/ru/vuln/CVE-2013-4758 · Nota
• http://rsyslog.com/rsyslog-7-4-2-v7-stable-released · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2013-4758 · Nota de Segurança
• http://rsyslog.com/rsyslog-7-5-2-v7-devel-released · Correção
• https://suse.com/security/cve/CVE-2013-4758 · Nota
• https://suse.com/security/cve/CVE-2011-3200 · Nota
• https://suse.com/security/cve/CVE-2014-3634 · Nota
• https://suse.com/security/cve/CVE-2013-6371 · Nota
• https://suse.com/security/cve/CVE-2013-6370 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10498-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2014-3683 · Nota
• http://openwall.com/lists/oss-security/2013/07/05/2 · Nota
• https://errata.altlinux.org/ALT-PU-2014-1540 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4758 · Nota de Segurança