Version in base suite: 8.2504.0-1 Base version: rsyslog_8.2504.0-1 Target version: rsyslog_8.2504.0-1+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/r/rsyslog/rsyslog_8.2504.0-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/r/rsyslog/rsyslog_8.2504.0-1+deb13u1.dsc changelog | 9 ++ gbp.conf | 2 patches/imptcp-guard-regex-framing-match-at-line-start.patch | 44 ++++++++++ patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch | 41 +++++++++ patches/series | 2 5 files changed, 97 insertions(+), 1 deletion(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpw4lfzro1/rsyslog_8.2504.0-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpw4lfzro1/rsyslog_8.2504.0-1+deb13u1.dsc: no acceptable signature found diff -Nru rsyslog-8.2504.0/debian/changelog rsyslog-8.2504.0/debian/changelog --- rsyslog-8.2504.0/debian/changelog 2025-05-06 16:39:50.000000000 +0000 +++ rsyslog-8.2504.0/debian/changelog 2026-08-24 13:56:02.000000000 +0000 @@ -1,3 +1,12 @@ +rsyslog (8.2504.0-1+deb13u1) trixie; urgency=medium + + * omfwd regression fix: avoid false active target change log message. + Patch backported from upstream Git. (Closes: #1141981) + * imptcp: reject invalid regex-framing recovery transitions. + (CVE-2026-19654, Closes: #1144616) + + -- Michael Biebl Mon, 24 Aug 2026 15:56:02 +0200 + rsyslog (8.2504.0-1) unstable; urgency=medium * New upstream version 8.2504.0 diff -Nru rsyslog-8.2504.0/debian/gbp.conf rsyslog-8.2504.0/debian/gbp.conf --- rsyslog-8.2504.0/debian/gbp.conf 2025-05-06 16:39:50.000000000 +0000 +++ rsyslog-8.2504.0/debian/gbp.conf 2026-08-24 13:56:02.000000000 +0000 @@ -1,5 +1,5 @@ [DEFAULT] pristine-tar = True patch-numbers = False -debian-branch = debian/master +debian-branch = debian/trixie upstream-branch = upstream/latest diff -Nru rsyslog-8.2504.0/debian/patches/imptcp-guard-regex-framing-match-at-line-start.patch rsyslog-8.2504.0/debian/patches/imptcp-guard-regex-framing-match-at-line-start.patch --- rsyslog-8.2504.0/debian/patches/imptcp-guard-regex-framing-match-at-line-start.patch 1970-01-01 00:00:00.000000000 +0000 +++ rsyslog-8.2504.0/debian/patches/imptcp-guard-regex-framing-match-at-line-start.patch 2026-08-24 13:56:02.000000000 +0000 @@ -0,0 +1,44 @@ +From: Rainer Gerhards +Date: Mon, 20 Jul 2026 17:19:28 +0200 +Subject: imptcp: guard regex framing match at line start + +Why +A regex match at the beginning of the receive buffer can form a +negative message length after oversize-frame recovery. + +Impact +Regex-framed imptcp listeners reject that invalid transition instead +of submitting a negative message length. + +Before/After +Before: a match with a zero line offset submitted an invalid length. +After: only a match following an existing line can submit a frame. + +Technical Overview +Mirror the line-offset guard used by the shared imtcp parser. +Leave existing regex framing and oversize recovery behavior unchanged. + +Security advisory: +https://github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7w29 + +Reported-by: Raphael Eikenberg (@eikendev) +With the help of AI-Agents: Codex + +(cherry picked from commit 07b3c40a5a78c79ed9109251f842ca7e955dd586) +--- + plugins/imptcp/imptcp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/plugins/imptcp/imptcp.c b/plugins/imptcp/imptcp.c +index 9223f20..16d2c32 100644 +--- a/plugins/imptcp/imptcp.c ++++ b/plugins/imptcp/imptcp.c +@@ -1054,7 +1054,7 @@ processDataRcvd_regexFraming(ptcpsess_t *const __restrict__ pThis, + pThis->iCurrLine = pThis->iMsg; + } else { + const int isMatch = !regexec(&inst->start_preg, (char*)pThis->pMsg+pThis->iCurrLine, 0, NULL, 0); +- if(isMatch) { ++ if (pThis->iCurrLine > 0 && isMatch) { + DBGPRINTF("regex match (%d), framing line: %s\n", pThis->iCurrLine, pThis->pMsg); + strcpy((char*)pThis->pMsg_save, (char*) pThis->pMsg+pThis->iCurrLine); + pThis->iMsg = pThis->iCurrLine - 1; diff -Nru rsyslog-8.2504.0/debian/patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch rsyslog-8.2504.0/debian/patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch --- rsyslog-8.2504.0/debian/patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch 1970-01-01 00:00:00.000000000 +0000 +++ rsyslog-8.2504.0/debian/patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch 2026-08-24 13:56:02.000000000 +0000 @@ -0,0 +1,41 @@ +From: Rainer Gerhards +Date: Sun, 8 Jun 2025 13:04:04 +0200 +Subject: omfwd regression fix: avoid false active target change log message + +Commit ffaf6dc4620da added proper variable sync, but dropped the check +if active count had actually changed. As such, the output was always +generated, which could pollute the log heavily. + +Code style fixes where dropped for the backport. + +(cherry picked from commit d6d340aaad6ea414a2fd4cf07d3f98c5c9334194) +--- + tools/omfwd.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/tools/omfwd.c b/tools/omfwd.c +index f4f1fdd..4e81461 100644 +--- a/tools/omfwd.c ++++ b/tools/omfwd.c +@@ -1146,15 +1146,17 @@ countActiveTargets(const wrkrInstanceData_t *const pWrkrData) { + oldVal = ATOMIC_FETCH_32BIT(&pWrkrData->pData->nActiveTargets, + &pWrkrData->pData->mut_nActiveTargets); + if (oldVal == activeTargets) { +- break; // No change needed ++ break; /* no change, so no log message either */ + } + newVal = activeTargets; + } while (!ATOMIC_CAS(&pWrkrData->pData->nActiveTargets, oldVal, newVal, + &pWrkrData->pData->mut_nActiveTargets)); + +- LogMsg(0, RS_RET_DEBUG, LOG_DEBUG, +- "omfwd: [wrkr %u] number of active targets changed from %d to %d", +- pWrkrData->wrkrID, oldVal, activeTargets); ++ if(oldVal != activeTargets) { ++ LogMsg(0, RS_RET_DEBUG, LOG_DEBUG, ++ "omfwd: [wrkr %u] number of active targets changed from %d to %d", ++ pWrkrData->wrkrID, oldVal, activeTargets); ++ } + } + + diff -Nru rsyslog-8.2504.0/debian/patches/series rsyslog-8.2504.0/debian/patches/series --- rsyslog-8.2504.0/debian/patches/series 2025-05-06 16:39:50.000000000 +0000 +++ rsyslog-8.2504.0/debian/patches/series 2026-08-24 13:56:02.000000000 +0000 @@ -1,3 +1,5 @@ Don-t-create-a-database.patch Increase-timeouts-in-imfile-basic-2GB-file-and-imfile-tru.patch Revert-queue-emit-better-warning-messages-on-queue-param-.patch +omfwd-regression-fix-avoid-false-active-target-change-log.patch +imptcp-guard-regex-framing-match-at-line-start.patch