PT-2013-5177 · Elastic+2 · Elasticsearch+2

Marius Ionescu + 1 · Published 2013-10-04 · Updated 2024-06-15 · CVE-2013-4758

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions rsyslog versions prior to 7.4.2 rsyslog versions prior to 7.5.2 devel

Description The issue is related to a double free vulnerability in the writeDataError function within the ElasticSearch plugin (omelasticsearch) of rsyslog. This vulnerability can be exploited by remote attackers when the errorfile is set to local logging, allowing them to cause a denial of service (crash) and potentially execute arbitrary code via a crafted JSON response.

Recommendations For versions prior to 7.4.2, update to version 7.4.2 or later. For versions prior to 7.5.2 devel, update to version 7.5.2 devel or later.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

ALT-PU-2014-1540

CVE-2013-4758

OPENSUSE-SU-2024:10498-1

Affected Products

Alt Linux

Elasticsearch

Rsyslog

References · 14

• http://rsyslog.com/rsyslog-7-4-2-v7-stable-released · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-4758 · Security Note
• http://rsyslog.com/rsyslog-7-5-2-v7-devel-released · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:10498-1 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2014-1540 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4758 · Security Note
• https://packages.altlinux.org/ru/vuln/CVE-2013-4758 · Note
• https://suse.com/security/cve/CVE-2013-4758 · Note
• https://suse.com/security/cve/CVE-2011-3200 · Note
• https://suse.com/security/cve/CVE-2014-3634 · Note
• https://suse.com/security/cve/CVE-2013-6371 · Note
• https://suse.com/security/cve/CVE-2013-6370 · Note
• https://suse.com/security/cve/CVE-2014-3683 · Note
• http://openwall.com/lists/oss-security/2013/07/05/2 · Note