Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Rainer Gerhards
rsyslog RainerScript replace() output length overflow (GHSA-48f2-29wv-5jgc)
oss-sec mailing list archives From: Rainer Gerhards <rgerhards () hq adiscon com> Date: Tue, 13 Oct 2026 19:00:00 +0200 Hello, rsyslog has disclosed GHSA-48f2-29wv-5jgc, an output length overflow in RainerScript replace(). The three-argument form of wrap() uses the same helper. This is not exposed by rsyslog's default small-message configuration.
rsyslog imdtls permitted-peer authorization bypass
oss-sec mailing list archives From: Rainer Gerhards <rgerhards () hq adiscon com> Date: Tue, 22 Sep 2026 18:25:00 +0200 Hello, The optional rsyslog imdtls input module did not enforce tls.permittedpeer after a successful CA-authenticated DTLS handshake when configured with tls.authmode="name" or tls.authmode="fingerprint". After SSL_accept() succeeds, imdtls performs the permitted-peer identity check. When that check fails, the module logged a warning but left the DTLS session active.
rsyslog: mmpstrucdata denial of service fixed in 8.2606.0
oss-sec mailing list archives From: Rainer Gerhards <rgerhards () hq adiscon com> Date: Sun, 20 Sep 2026 17:17:40 +0200 Hello, We are publishing a GitHub Security Advisory for a denial-of-service vulnerability in the rsyslog mmpstrucdata module: https://github.com/rsyslog/rsyslog/security/advisories/GHSA-2whq-6rcm-64m8 Affected configurations use mmpstrucdata to parse RFC 5424 structured data and accept messages large enough to carry an oversized parameter value.
CVE-2026-78002: rsyslog RainerScript replace() heap buffer overflow
oss-sec mailing list archives From: Rainer Gerhards <rgerhards () hq adiscon com> Date: Sat, 29 Aug 2026 18:29:51 +0200 Hello, This is the public follow-up to the earlier embargoed notification to the distros list. The embargo ended on 2026-08-24. We apologize for the delayed oss-security posting. rsyslog contains a heap buffer overflow in the core RainerScript replace() function. The three-argument form of wrap() uses the same implementation and is also affected.
rsyslog: omfile dynaFile containment hardening (GHSA-xmp9-244p-5ggv)
oss-sec mailing list archives From: Rainer Gerhards <rgerhards () hq adiscon com> Date: Thu, 20 Aug 2026 13:02:27 +0200 Hello, rsyslog has published GHSA-xmp9-244p-5ggv covering hardening of dynamic filename handling in the omfile output module: https://github.com/rsyslog/rsyslog/security/advisories/GHSA-xmp9-244p-5ggv The affected area is omfile configurations that use dynaFile.
rsyslog v8.36.0 through v8.2606.0: imptcp regex-framing remote denial of service
oss-sec mailing list archives From: Rainer Gerhards <rgerhards () hq adiscon com> Date: Wed, 22 Jul 2026 12:34:37 +0200 Hello, The rsyslog project has published a security advisory and proposed upstream fix for a configuration-dependent denial-of-service issue in the optional imptcp input module. Summary ======= A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd. The issue is not active in a default installation.
CVE-2026-61548: rsyslog mmpstrucdata stack overflow
oss-sec mailing list archives From: Rainer Gerhards <rgerhards () hq adiscon com> Date: Mon, 20 Jul 2026 12:14:52 +0200 Hello, A CVE identifier, CVE-2026-61548, has been assigned to a stack-based buffer overflow in rsyslog's optional mmpstrucdata module.
CVE-2026-55556: rsyslog imhttp Basic Auth heap overflow
oss-sec mailing list archives From: Rainer Gerhards <rgerhards () hq adiscon com> Date: Tue, 23 Jun 2026 17:15:54 +0200 Hello, We are publishing CVE-2026-55556 for a heap overflow in the optional rsyslog imhttp input module. imhttp is a contributed rsyslog plugin. It is not part of typical default rsyslog installations, is seldom installed in production deployments, and is not frequently packaged by distributions.
librelp Remote Code Execution
Proof of concept exploit for a buffer overflow remote code execution vulnerability in librelp.
CVE-2022-24903: rsyslog < 8.2204.1 heap buffer overrun
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: Rainer Gerhards <rgerhards () hq adiscon com> Date: Thu, 5 May 2022 14:10:43 +0200 Severity: High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H This is a worst case rating. When syslog best practices are applied (no Internet access to rsyslog receivers) the severity is lower. Details below.
simplifying rsyslog JSON generation - Security Boulevard
With RESTful APIs, like for example ElasticSearch, you need to generate JSON strings. Rsyslog will soon do this in a very easy to use way. The current method is not hard either, but often looks a bit clumsy. The new way of doing things will most probably be part of the 8.33 release. You now can define a template as follows: This will generate JSON.
experimental debian rsyslog packages - Security Boulevard
We often receive requests for Debian packages. So far, we did not package for recent Debian, as the Debian maintainer, Michael Biebl, does an excellent job. Other than us, he is a real expert on Debian policies and infrastructure. Nevertheless, we now took his package sources and gave the Suse Open Build Service a try. In the end result, we now seem to have usable Debian packages (and more) available at: I would be very interested in your feedback on the first incarnation of this project.
docker group security risk - Security Boulevard
The Docker doc spells out that there are security concerns of adding a user to the docker group. Unfortunately, they do not precisely give what the concern is. I guess that is a “security-by-obscurity” approach trying to avoid bad things. Practice show this isn’t useful: the bad guys know anyways, and the casual user has a bad time understanding the actual risk involved.
What Healthcare.gov has to do with the Hawaii false alarm - and what to do about it
By now, you’ve heard of the Hawaii False Alarm, and about the blowback and blame as people try to sort out how this could have happened. In government circles, however, there have been empathy and knowing cringes . It is the norm, not the exception, that government systems are confusing and hard to use. Horrible mistakes happen when people use clunky government systems?—?they just usually don’t make the news.
What Healthcare.gov has to do with the Hawaii false alarm - and what to do about it
By now, you’ve heard of the Hawaii False Alarm, and about the blowback and blame as people try to sort out how this could have happened. In government circles, however, there have been empathy and knowing cringes . It is the norm, not the exception, that government systems are confusing and hard to use. Horrible mistakes happen when people use clunky government systems?—?they just usually don’t make the news.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Rainer
Contact Rainer, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack