Security update for librelp SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0828-1 Final 1 1 2018-03-27T11:26:12Z current 2018-03-27T11:26:12Z 2018-03-27T11:26:12Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for librelp This update for librelp fixes the following issues: CVE-2018-1000140 (bsc#1086730): librelp contained a stack-based buffer overflow in the checking of x509 certificates. A remote attacker with an access to the rsyslog logging facility could have exploited it by sending a specially crafted x509 certificate. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-6-2018-553,SUSE-SLE-RPI-12-SP2-2018-553,SUSE-SLE-SAP-12-SP1-2018-553,SUSE-SLE-SDK-12-SP2-2018-553,SUSE-SLE-SERVER-12-2018-553,SUSE-SLE-SERVER-12-SP1-2018-553,SUSE-SLE-SERVER-12-SP2-2018-553 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180828-1/ Link for SUSE-SU-2018:0828-1 https://lists.opensuse.org/opensuse-security-announce/2018-03/msg00063.html E-Mail link for SUSE-SU-2018:0828-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1086730 SUSE Bug 1086730 https://www.suse.com/security/cve/CVE-2018-1000140/ SUSE CVE CVE-2018-1000140 page SUSE Linux Enterprise Server 12 SP1-LTSS SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE OpenStack Cloud 6 librelp0-1.2.7-3.3.1 librelp-devel-1.2.7-3.3.1 librelp0-1.2.7-3.3.1 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS librelp0-1.2.7-3.3.1 as a component of SUSE Linux Enterprise Server 12 SP2 librelp0-1.2.7-3.3.1 as a component of SUSE Linux Enterprise Server 12-LTSS librelp0-1.2.7-3.3.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 librelp0-1.2.7-3.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 librelp0-1.2.7-3.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 librelp-devel-1.2.7-3.3.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 librelp0-1.2.7-3.3.1 as a component of SUSE OpenStack Cloud 6 rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate. CVE-2018-1000140 SUSE Linux Enterprise Server 12 SP1-LTSS:librelp0-1.2.7-3.3.1 SUSE Linux Enterprise Server 12 SP2:librelp0-1.2.7-3.3.1 SUSE Linux Enterprise Server 12-LTSS:librelp0-1.2.7-3.3.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:librelp0-1.2.7-3.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:librelp0-1.2.7-3.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:librelp0-1.2.7-3.3.1 SUSE Linux Enterprise Software Development Kit 12 SP2:librelp-devel-1.2.7-3.3.1 SUSE OpenStack Cloud 6:librelp0-1.2.7-3.3.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180828-1/ https://www.suse.com/security/cve/CVE-2018-1000140.html CVE-2018-1000140 https://bugzilla.suse.com/1086730 SUSE Bug 1086730