Debian Package Tracker

general

source: rsyslog (main)
version: 8.2006.0-2
maintainer: Michael Biebl (DMD)
arch: any
std-ver: 4.5.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 8.4.2-1+deb8u2
o-o-sec: 8.4.2-1+deb8u3
oldstable: 8.24.0-1
old-bpo: 8.1901.0-1~bpo9+1
stable: 8.1901.0-1
testing: 8.2006.0-2
unstable: 8.2006.0-2

versioned links

8.4.2-1+deb8u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8.4.2-1+deb8u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8.24.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8.1901.0-1~bpo9+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8.1901.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8.2006.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

rsyslog (34 bugs: 0, 11, 23, 0)
rsyslog-czmq
rsyslog-elasticsearch
rsyslog-gnutls (1 bugs: 0, 1, 0, 0)
rsyslog-gssapi (1 bugs: 0, 0, 1, 0)
rsyslog-hiredis
rsyslog-kafka
rsyslog-mongodb (2 bugs: 0, 1, 1, 0)
rsyslog-mysql (1 bugs: 0, 1, 0, 0)
rsyslog-openssl
rsyslog-pgsql (2 bugs: 0, 2, 0, 0)
rsyslog-relp

action needed

7 bugs tagged patch in the BTS normal

The BTS contains patches fixing 7 bugs (9 if counting merged bugs), consider including or untagging them.

Created: 2020-06-28 Last update: 2020-08-08 16:02

Multiarch hinter reports 9 issue(s) normal

There are issues with the multiarch metadata for this package.

rsyslog-czmq could be marked Multi-Arch: same
rsyslog-elasticsearch could be marked Multi-Arch: same
rsyslog-gnutls could be marked Multi-Arch: same
rsyslog-gssapi could be marked Multi-Arch: same
rsyslog-hiredis could be marked Multi-Arch: same
rsyslog-kafka could be marked Multi-Arch: same
rsyslog-mongodb could be marked Multi-Arch: same
rsyslog-openssl could be marked Multi-Arch: same
rsyslog-relp could be marked Multi-Arch: same

Created: 2020-06-28 Last update: 2020-08-08 15:14

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2020-07-02 Last update: 2020-08-08 15:13

Depends on packages which need a new maintainer normal

The packages that rsyslog depends on which need a new maintainer are:

dh-exec (#851746)
- Build-Depends: dh-exec

Created: 2019-11-22 Last update: 2020-08-08 15:11

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 64adeb85dd14494ba1bd5bd15d48bee8e7910aea
Author: Christian Ehrhardt <christian.ehrhardt@canonical.com>
Date:   Mon Jun 29 13:34:04 2020 +0200

    d/p/Increase-timeouts-in-imfile-basic-2GB-file-and-imfile-tru.patch: bump even further for riscv64
    
    Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>

Created: 2020-07-14 Last update: 2020-08-06 01:08

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2020-07-29 Last update: 2020-07-29 12:34

3 ignored security issues in stretch low

There are 3 open security issues in stretch.

3 issues skipped by the security teams:

CVE-2018-16881: A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which would cause rsyslog to crash. Versions before 8.27.0 are vulnerable.
CVE-2019-17041: An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow.
CVE-2019-17042: An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon), but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow.

Please fix them.

Created: 2019-01-26 Last update: 2020-08-07 06:08

2 ignored security issues in buster low

There are 2 open security issues in buster.

2 issues skipped by the security teams:

CVE-2019-17041: An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow.
CVE-2019-17042: An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon), but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow.

Please fix them.

Created: 2019-10-08 Last update: 2020-08-07 06:08

testing migrations

This package will soon be part of the auto-hiredis transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2020-07-02] rsyslog 8.2006.0-2 MIGRATED to testing (Debian testing watch)
[2020-06-27] Accepted rsyslog 8.2006.0-2 (source) into unstable (Michael Biebl)
[2020-06-24] Accepted rsyslog 8.2006.0-1 (source) into unstable (Michael Biebl)
[2020-05-04] rsyslog 8.2004.0-1 MIGRATED to testing (Debian testing watch)
[2020-04-28] Accepted rsyslog 8.2004.0-1 (source) into unstable (Michael Biebl)
[2020-03-04] rsyslog 8.2002.0-2 MIGRATED to testing (Debian testing watch)
[2020-02-28] Accepted rsyslog 8.2002.0-2 (source) into unstable (Michael Biebl)
[2020-02-26] Accepted rsyslog 8.2002.0-1 (source) into unstable (Michael Biebl)
[2020-01-28] rsyslog 8.2001.0-1 MIGRATED to testing (Debian testing watch)
[2020-01-22] Accepted rsyslog 8.2001.0-1 (source) into unstable (Michael Biebl)
[2019-11-18] rsyslog 8.1911.0-1 MIGRATED to testing (Debian testing watch)
[2019-11-13] Accepted rsyslog 8.1911.0-1 (source) into unstable (Michael Biebl)
[2019-10-30] rsyslog 8.1910.0-2 MIGRATED to testing (Debian testing watch)
[2019-10-24] Accepted rsyslog 8.1910.0-2 (source) into unstable (Michael Biebl)
[2019-10-17] Accepted rsyslog 8.1910.0-1 (source) into unstable (Michael Biebl)
[2019-10-10] Accepted rsyslog 8.4.2-1+deb8u3 (source amd64) into oldoldstable (Chris Lamb)
[2019-08-20] Accepted rsyslog 8.1908.0-1 (source) into unstable (Michael Biebl)
[2019-07-22] Accepted rsyslog 8.1907.0-2 (source amd64) into unstable, unstable (Michael Biebl)
[2019-07-15] rsyslog 8.1907.0-1 MIGRATED to testing (Debian testing watch)
[2019-07-09] Accepted rsyslog 8.1907.0-1 (source) into unstable (Michael Biebl)
[2019-07-08] Accepted rsyslog 8.1905.0-4 (source) into unstable (Michael Biebl)
[2019-07-02] Accepted rsyslog 8.1905.0-3 (source) into experimental (Michael Biebl)
[2019-05-29] Accepted rsyslog 8.1905.0-2 (source) into experimental (Michael Biebl)
[2019-05-28] Accepted rsyslog 8.1905.0-1 (source) into experimental (Michael Biebl)
[2019-04-17] Accepted rsyslog 8.1904.0-1 (source) into experimental (Michael Biebl)
[2019-04-11] Accepted rsyslog 8.1903.0-4 (source) into experimental (Michael Biebl)
[2019-03-26] Accepted rsyslog 8.1903.0-3 (source) into experimental (Michael Biebl)
[2019-03-26] Accepted rsyslog 8.1903.0-2 (source) into experimental (Michael Biebl)
[2019-03-25] Accepted rsyslog 8.1903.0-1 (source) into experimental (Michael Biebl)
[2019-03-10] Accepted rsyslog 8.1901.0-1~bpo9+1 (source) into stretch-backports (Michael Biebl)

bugs [bug history graph]

all: 41 44
RC: 0
I&N: 16 17
M&W: 25 27
F&P: 0
patch: 7 9

links

homepage
lintian (0, 1)
buildd: logs, clang, reproducibility, cross
popcon
browse source code
edit tags
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 8.2006.0-2ubuntu1
134 bugs (5 patches)
patches for 8.2006.0-2ubuntu1