CVE-2022-38725

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-38725
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-38725.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-38725
Aliases
  • GHSA-7932-4fc6-pvmc
Related
Published
2023-01-23T16:15:10Z
Modified
2024-12-05T15:35:09.210002Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function. syslog-ng Premium Edition 7.0.30 and syslog-ng Store Box 6.10.0 are also affected.

References

Affected packages

Alpine:v3.17 / syslog-ng

Package

Name
syslog-ng
Purl
pkg:apk/alpine/syslog-ng?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.38.1-r0

Affected versions

2.*

2.1.4-r0
2.1.4-r1
2.1.4-r2
2.1.4-r3

3.*

3.6.2-r0
3.6.2-r1
3.6.4-r0
3.7.1-r0
3.7.2-r0
3.7.2-r1
3.7.2-r2
3.7.2-r3
3.9.1-r0
3.9.1-r1
3.9.1-r2
3.9.1-r3
3.13.2-r0
3.13.2-r1
3.13.2-r2
3.13.2-r3
3.13.2-r4
3.18.1-r0
3.18.1-r1
3.18.1-r2
3.19.1-r0
3.19.1-r1
3.22.1-r0
3.22.1-r1
3.22.1-r2
3.25.1-r0
3.25.1-r1
3.26.1-r0
3.26.1-r1
3.27.1-r0
3.29.1-r0
3.30.1-r0
3.30.1-r1
3.30.1-r2
3.30.1-r3
3.30.1-r4
3.30.1-r5
3.36.1-r0
3.36.1-r1

Alpine:v3.18 / syslog-ng

Package

Name
syslog-ng
Purl
pkg:apk/alpine/syslog-ng?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.38.1-r0

Affected versions

2.*

2.1.4-r0
2.1.4-r1
2.1.4-r2
2.1.4-r3

3.*

3.6.2-r0
3.6.2-r1
3.6.4-r0
3.7.1-r0
3.7.2-r0
3.7.2-r1
3.7.2-r2
3.7.2-r3
3.9.1-r0
3.9.1-r1
3.9.1-r2
3.9.1-r3
3.13.2-r0
3.13.2-r1
3.13.2-r2
3.13.2-r3
3.13.2-r4
3.18.1-r0
3.18.1-r1
3.18.1-r2
3.19.1-r0
3.19.1-r1
3.22.1-r0
3.22.1-r1
3.22.1-r2
3.25.1-r0
3.25.1-r1
3.26.1-r0
3.26.1-r1
3.27.1-r0
3.29.1-r0
3.30.1-r0
3.30.1-r1
3.30.1-r2
3.30.1-r3
3.30.1-r4
3.30.1-r5
3.36.1-r0
3.36.1-r1

Alpine:v3.19 / syslog-ng

Package

Name
syslog-ng
Purl
pkg:apk/alpine/syslog-ng?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.38.1-r0

Affected versions

2.*

2.1.4-r0
2.1.4-r1
2.1.4-r2
2.1.4-r3

3.*

3.6.2-r0
3.6.2-r1
3.6.4-r0
3.7.1-r0
3.7.2-r0
3.7.2-r1
3.7.2-r2
3.7.2-r3
3.9.1-r0
3.9.1-r1
3.9.1-r2
3.9.1-r3
3.13.2-r0
3.13.2-r1
3.13.2-r2
3.13.2-r3
3.13.2-r4
3.18.1-r0
3.18.1-r1
3.18.1-r2
3.19.1-r0
3.19.1-r1
3.22.1-r0
3.22.1-r1
3.22.1-r2
3.25.1-r0
3.25.1-r1
3.26.1-r0
3.26.1-r1
3.27.1-r0
3.29.1-r0
3.30.1-r0
3.30.1-r1
3.30.1-r2
3.30.1-r3
3.30.1-r4
3.30.1-r5
3.36.1-r0
3.36.1-r1

Alpine:v3.20 / syslog-ng

Package

Name
syslog-ng
Purl
pkg:apk/alpine/syslog-ng?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.38.1-r0

Affected versions

2.*

2.1.4-r0
2.1.4-r1
2.1.4-r2
2.1.4-r3

3.*

3.6.2-r0
3.6.2-r1
3.6.4-r0
3.7.1-r0
3.7.2-r0
3.7.2-r1
3.7.2-r2
3.7.2-r3
3.9.1-r0
3.9.1-r1
3.9.1-r2
3.9.1-r3
3.13.2-r0
3.13.2-r1
3.13.2-r2
3.13.2-r3
3.13.2-r4
3.18.1-r0
3.18.1-r1
3.18.1-r2
3.19.1-r0
3.19.1-r1
3.22.1-r0
3.22.1-r1
3.22.1-r2
3.25.1-r0
3.25.1-r1
3.26.1-r0
3.26.1-r1
3.27.1-r0
3.29.1-r0
3.30.1-r0
3.30.1-r1
3.30.1-r2
3.30.1-r3
3.30.1-r4
3.30.1-r5
3.36.1-r0
3.36.1-r1

Alpine:v3.21 / syslog-ng

Package

Name
syslog-ng
Purl
pkg:apk/alpine/syslog-ng?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.38.1-r0

Affected versions

2.*

2.1.4-r0
2.1.4-r1
2.1.4-r2
2.1.4-r3

3.*

3.6.2-r0
3.6.2-r1
3.6.4-r0
3.7.1-r0
3.7.2-r0
3.7.2-r1
3.7.2-r2
3.7.2-r3
3.9.1-r0
3.9.1-r1
3.9.1-r2
3.9.1-r3
3.13.2-r0
3.13.2-r1
3.13.2-r2
3.13.2-r3
3.13.2-r4
3.18.1-r0
3.18.1-r1
3.18.1-r2
3.19.1-r0
3.19.1-r1
3.22.1-r0
3.22.1-r1
3.22.1-r2
3.25.1-r0
3.25.1-r1
3.26.1-r0
3.26.1-r1
3.27.1-r0
3.29.1-r0
3.30.1-r0
3.30.1-r1
3.30.1-r2
3.30.1-r3
3.30.1-r4
3.30.1-r5
3.36.1-r0
3.36.1-r1

Debian:11 / syslog-ng

Package

Name
syslog-ng
Purl
pkg:deb/debian/syslog-ng?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.28.1-2+deb11u1

Affected versions

3.*

3.28.1-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / syslog-ng

Package

Name
syslog-ng
Purl
pkg:deb/debian/syslog-ng?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.38.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / syslog-ng

Package

Name
syslog-ng
Purl
pkg:deb/debian/syslog-ng?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.38.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/syslog-ng/syslog-ng

Affected ranges

Type
GIT
Repo
https://github.com/syslog-ng/syslog-ng
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7a087facda3640096a350986aa201a3eca8e0108

Affected versions

syslog-ng-3.*

syslog-ng-3.10.1
syslog-ng-3.11.1
syslog-ng-3.12.1
syslog-ng-3.13.1
syslog-ng-3.13.2
syslog-ng-3.14.1
syslog-ng-3.15.1
syslog-ng-3.16.1
syslog-ng-3.17.1
syslog-ng-3.17.2
syslog-ng-3.18.1
syslog-ng-3.19.1
syslog-ng-3.20.1
syslog-ng-3.21.1
syslog-ng-3.22.1
syslog-ng-3.23.1
syslog-ng-3.24.1
syslog-ng-3.25.1
syslog-ng-3.26.1
syslog-ng-3.27.1
syslog-ng-3.28.1
syslog-ng-3.29.1
syslog-ng-3.30.1
syslog-ng-3.31.1
syslog-ng-3.31.2
syslog-ng-3.32.1
syslog-ng-3.33.1
syslog-ng-3.33.2
syslog-ng-3.34.1
syslog-ng-3.35.1
syslog-ng-3.36.1
syslog-ng-3.37.1
syslog-ng-3.6.0alpha1
syslog-ng-3.6.0alpha2
syslog-ng-3.6.0alpha3
syslog-ng-3.6.0beta1
syslog-ng-3.6.0beta2
syslog-ng-3.6.0rc1
syslog-ng-3.6.0rc2
syslog-ng-3.6.1
syslog-ng-3.7.0alpha1
syslog-ng-3.7.0alpha2
syslog-ng-3.7.0beta1
syslog-ng-3.7.0beta2
syslog-ng-3.7.1
syslog-ng-3.7.2
syslog-ng-3.8.0beta1
syslog-ng-3.8.0beta2
syslog-ng-3.8.1
syslog-ng-3.9.1

v3.*

v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.8
v3.1.0
v3.1beta1
v3.1beta2
v3.2.1
v3.2.2
v3.2alpha1
v3.2beta1
v3.3.0alpha1
v3.3.0alpha2
v3.3.0beta1
v3.3.0beta2
v3.3.1
v3.3.2
v3.3.3
v3.3.4
v3.3.5
v3.3.5.90
v3.3.6
v3.3.6.90
v3.3.6.91
v3.3.7
v3.4.0alpha1
v3.4.0alpha2
v3.4.0alpha3
v3.4.0beta1
v3.4.0rc1
v3.4.0rc2
v3.4.1
v3.4.2
v3.4.3
v3.5.0beta1
v3.5.0beta2
v3.5.0beta3
v3.5.0rc1
v3.5.1
v3.5.2
v3.5.3
v3.5.4
v3.5.4.1
v3.5.5
v3.5.6