| Package | Affected versions | Patched versions |
|---|---|---|
| rsyslog | = 3.12.1= 3.12.2= 3.12.3= 3.12.4= 3.12.5= 3.13.0= 3.15.0= 3.15.1= 3.17.0= 3.17.1= 3.17.4= 3.17.5= 3.19.0= 3.19.1= 3.19.10= 3.19.11= 3.19.12= 3.19.2= 3.19.3= 3.19.4= 3.19.5= 3.19.6= 3.19.7= 3.19.8= 3.19.9= 3.20.0= 4.1.0= 4.1.1 |
The ACL handling in rsyslog 3.12.1 to 3.20.0, 4.1.0, and 4.1.1 does not follow $AllowedSender directive, which allows remote attackers to bypass intended access restrictions and spoof log messages or create a large number of spurious messages.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free