Version in base suite: 8.2504.0-1 Base version: rsyslog_8.2504.0-1 Target version: rsyslog_8.2504.0-1+deb13u2 Base file: /srv/ftp-master.debian.org/ftp/pool/main/r/rsyslog/rsyslog_8.2504.0-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/r/rsyslog/rsyslog_8.2504.0-1+deb13u2.dsc changelog | 21 ++++ gbp.conf | 2 patches/imptcp-guard-regex-framing-match-at-line-start.patch | 44 ++++++++++ patches/mmpstrucdata-Fix-stack-buffer-overflow-with-oversized-RFC.patch | 41 +++++++++ patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch | 41 +++++++++ patches/rainerscript-align-replace-sizing-rewind.patch | 43 +++++++++ patches/series | 4 7 files changed, 195 insertions(+), 1 deletion(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpoms1y4wi/rsyslog_8.2504.0-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpoms1y4wi/rsyslog_8.2504.0-1+deb13u2.dsc: no acceptable signature found diff -Nru rsyslog-8.2504.0/debian/changelog rsyslog-8.2504.0/debian/changelog --- rsyslog-8.2504.0/debian/changelog 2025-05-06 16:39:50.000000000 +0000 +++ rsyslog-8.2504.0/debian/changelog 2026-08-30 00:19:20.000000000 +0000 @@ -1,3 +1,24 @@ +rsyslog (8.2504.0-1+deb13u2) trixie; urgency=medium + + * rainerscript: Avoid heap buffer overflow in replace() function. + Patch cherry-picked from upstream Git. + (CVE-2026-78002, Closes: #1145980) + * mmpstrucdata: Fix stack buffer overflow with oversized RFC5424 structured + data. + Patch backported from upstream Git. + (CVE-2026-61548) + + -- Michael Biebl Sun, 30 Aug 2026 02:19:20 +0200 + +rsyslog (8.2504.0-1+deb13u1) trixie; urgency=medium + + * omfwd regression fix: avoid false active target change log message. + Patch backported from upstream Git. (Closes: #1141981) + * imptcp: reject invalid regex-framing recovery transitions. + (CVE-2026-19654, Closes: #1144616) + + -- Michael Biebl Mon, 24 Aug 2026 15:56:02 +0200 + rsyslog (8.2504.0-1) unstable; urgency=medium * New upstream version 8.2504.0 diff -Nru rsyslog-8.2504.0/debian/gbp.conf rsyslog-8.2504.0/debian/gbp.conf --- rsyslog-8.2504.0/debian/gbp.conf 2025-05-06 16:39:50.000000000 +0000 +++ rsyslog-8.2504.0/debian/gbp.conf 2026-08-30 00:19:20.000000000 +0000 @@ -1,5 +1,5 @@ [DEFAULT] pristine-tar = True patch-numbers = False -debian-branch = debian/master +debian-branch = debian/trixie upstream-branch = upstream/latest diff -Nru rsyslog-8.2504.0/debian/patches/imptcp-guard-regex-framing-match-at-line-start.patch rsyslog-8.2504.0/debian/patches/imptcp-guard-regex-framing-match-at-line-start.patch --- rsyslog-8.2504.0/debian/patches/imptcp-guard-regex-framing-match-at-line-start.patch 1970-01-01 00:00:00.000000000 +0000 +++ rsyslog-8.2504.0/debian/patches/imptcp-guard-regex-framing-match-at-line-start.patch 2026-08-30 00:19:20.000000000 +0000 @@ -0,0 +1,44 @@ +From: Rainer Gerhards +Date: Mon, 20 Jul 2026 17:19:28 +0200 +Subject: imptcp: guard regex framing match at line start + +Why +A regex match at the beginning of the receive buffer can form a +negative message length after oversize-frame recovery. + +Impact +Regex-framed imptcp listeners reject that invalid transition instead +of submitting a negative message length. + +Before/After +Before: a match with a zero line offset submitted an invalid length. +After: only a match following an existing line can submit a frame. + +Technical Overview +Mirror the line-offset guard used by the shared imtcp parser. +Leave existing regex framing and oversize recovery behavior unchanged. + +Security advisory: +https://github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7w29 + +Reported-by: Raphael Eikenberg (@eikendev) +With the help of AI-Agents: Codex + +(cherry picked from commit 07b3c40a5a78c79ed9109251f842ca7e955dd586) +--- + plugins/imptcp/imptcp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/plugins/imptcp/imptcp.c b/plugins/imptcp/imptcp.c +index 9223f20..16d2c32 100644 +--- a/plugins/imptcp/imptcp.c ++++ b/plugins/imptcp/imptcp.c +@@ -1054,7 +1054,7 @@ processDataRcvd_regexFraming(ptcpsess_t *const __restrict__ pThis, + pThis->iCurrLine = pThis->iMsg; + } else { + const int isMatch = !regexec(&inst->start_preg, (char*)pThis->pMsg+pThis->iCurrLine, 0, NULL, 0); +- if(isMatch) { ++ if (pThis->iCurrLine > 0 && isMatch) { + DBGPRINTF("regex match (%d), framing line: %s\n", pThis->iCurrLine, pThis->pMsg); + strcpy((char*)pThis->pMsg_save, (char*) pThis->pMsg+pThis->iCurrLine); + pThis->iMsg = pThis->iCurrLine - 1; diff -Nru rsyslog-8.2504.0/debian/patches/mmpstrucdata-Fix-stack-buffer-overflow-with-oversized-RFC.patch rsyslog-8.2504.0/debian/patches/mmpstrucdata-Fix-stack-buffer-overflow-with-oversized-RFC.patch --- rsyslog-8.2504.0/debian/patches/mmpstrucdata-Fix-stack-buffer-overflow-with-oversized-RFC.patch 1970-01-01 00:00:00.000000000 +0000 +++ rsyslog-8.2504.0/debian/patches/mmpstrucdata-Fix-stack-buffer-overflow-with-oversized-RFC.patch 2026-08-30 00:19:20.000000000 +0000 @@ -0,0 +1,41 @@ +From: Rainer Gerhards +Date: Tue, 2 Jun 2026 14:00:15 +0200 +Subject: mmpstrucdata: Fix stack buffer overflow with oversized RFC5424 + structured data + +Partial backport of commit bcda60a3692efdf0c8e44102528f5a0ebe0dec6d + +See https://github.com/rsyslog/rsyslog/security/advisories/GHSA-8qmr-c66f-g368 +--- + plugins/mmpstrucdata/mmpstrucdata.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/plugins/mmpstrucdata/mmpstrucdata.c b/plugins/mmpstrucdata/mmpstrucdata.c +index 5f1ca80..eb81047 100644 +--- a/plugins/mmpstrucdata/mmpstrucdata.c ++++ b/plugins/mmpstrucdata/mmpstrucdata.c +@@ -256,7 +256,7 @@ parseSD_PARAM(instanceData *const pData, uchar *sdbuf, int lenbuf, int *curridx, + { + int i; + uchar pName[33]; +- uchar pVal[32*1024]; ++ uchar *pVal = NULL; + struct json_object *jval; + DEFiRet; + +@@ -270,6 +270,7 @@ parseSD_PARAM(instanceData *const pData, uchar *sdbuf, int lenbuf, int *curridx, + ABORT_FINALIZE(RS_RET_STRUC_DATA_INVLD); + } + ++i; ++ CHKmalloc(pVal = malloc(lenbuf - i + 1)); + CHKiRet(parsePARAM_VALUE(sdbuf, lenbuf, &i, pVal)); + if(sdbuf[i] != '"') { + ABORT_FINALIZE(RS_RET_STRUC_DATA_INVLD); +@@ -281,6 +282,7 @@ parseSD_PARAM(instanceData *const pData, uchar *sdbuf, int lenbuf, int *curridx, + + *curridx = i; + finalize_it: ++ free(pVal); + RETiRet; + } + diff -Nru rsyslog-8.2504.0/debian/patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch rsyslog-8.2504.0/debian/patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch --- rsyslog-8.2504.0/debian/patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch 1970-01-01 00:00:00.000000000 +0000 +++ rsyslog-8.2504.0/debian/patches/omfwd-regression-fix-avoid-false-active-target-change-log.patch 2026-08-30 00:19:20.000000000 +0000 @@ -0,0 +1,41 @@ +From: Rainer Gerhards +Date: Sun, 8 Jun 2025 13:04:04 +0200 +Subject: omfwd regression fix: avoid false active target change log message + +Commit ffaf6dc4620da added proper variable sync, but dropped the check +if active count had actually changed. As such, the output was always +generated, which could pollute the log heavily. + +Code style fixes where dropped for the backport. + +(cherry picked from commit d6d340aaad6ea414a2fd4cf07d3f98c5c9334194) +--- + tools/omfwd.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/tools/omfwd.c b/tools/omfwd.c +index f4f1fdd..4e81461 100644 +--- a/tools/omfwd.c ++++ b/tools/omfwd.c +@@ -1146,15 +1146,17 @@ countActiveTargets(const wrkrInstanceData_t *const pWrkrData) { + oldVal = ATOMIC_FETCH_32BIT(&pWrkrData->pData->nActiveTargets, + &pWrkrData->pData->mut_nActiveTargets); + if (oldVal == activeTargets) { +- break; // No change needed ++ break; /* no change, so no log message either */ + } + newVal = activeTargets; + } while (!ATOMIC_CAS(&pWrkrData->pData->nActiveTargets, oldVal, newVal, + &pWrkrData->pData->mut_nActiveTargets)); + +- LogMsg(0, RS_RET_DEBUG, LOG_DEBUG, +- "omfwd: [wrkr %u] number of active targets changed from %d to %d", +- pWrkrData->wrkrID, oldVal, activeTargets); ++ if(oldVal != activeTargets) { ++ LogMsg(0, RS_RET_DEBUG, LOG_DEBUG, ++ "omfwd: [wrkr %u] number of active targets changed from %d to %d", ++ pWrkrData->wrkrID, oldVal, activeTargets); ++ } + } + + diff -Nru rsyslog-8.2504.0/debian/patches/rainerscript-align-replace-sizing-rewind.patch rsyslog-8.2504.0/debian/patches/rainerscript-align-replace-sizing-rewind.patch --- rsyslog-8.2504.0/debian/patches/rainerscript-align-replace-sizing-rewind.patch 1970-01-01 00:00:00.000000000 +0000 +++ rsyslog-8.2504.0/debian/patches/rainerscript-align-replace-sizing-rewind.patch 2026-08-30 00:19:20.000000000 +0000 @@ -0,0 +1,43 @@ +From: Rainer Gerhards +Date: Thu, 20 Aug 2026 15:53:16 +0200 +Subject: rainerscript: align replace sizing rewind + +Why: +The sizing pass skipped a candidate match that the copy pass replaced. + +Impact: +Overlapping partial matches now receive a correctly sized output string. + +Before/After: +Before, the two passes resumed at different source offsets; after, both +resume at the same offset. + +Technical Overview: +Make the sizing pass rewind both its source index and tentative output +length by the full failed partial-match length. This mirrors the copy pass +and ensures that every replacement counted is also written exactly once. +The change preserves the existing empty-find, replacement, and trailing +partial-match behavior. + +With the help of AI-Agents: Codex + +(cherry picked from commit 667e3f61aec5ee02c5c2ee6f0f8accf6fe4301a9) +--- + grammar/rainerscript.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grammar/rainerscript.c b/grammar/rainerscript.c +index 88c47e5..037b3f6 100644 +--- a/grammar/rainerscript.c ++++ b/grammar/rainerscript.c +@@ -1761,8 +1761,8 @@ doFuncReplace(struct svar *__restrict__ const operandVal, struct svar *__restric + if (src_buff[i] == find[j]) { + j++; + } else if (j > 0) { +- i -= (j - 1); +- lDst -= (j - 1); ++ i -= j; ++ lDst -= j; + j = 0; + } + } diff -Nru rsyslog-8.2504.0/debian/patches/series rsyslog-8.2504.0/debian/patches/series --- rsyslog-8.2504.0/debian/patches/series 2025-05-06 16:39:50.000000000 +0000 +++ rsyslog-8.2504.0/debian/patches/series 2026-08-30 00:19:20.000000000 +0000 @@ -1,3 +1,7 @@ Don-t-create-a-database.patch Increase-timeouts-in-imfile-basic-2GB-file-and-imfile-tru.patch Revert-queue-emit-better-warning-messages-on-queue-param-.patch +omfwd-regression-fix-avoid-false-active-target-change-log.patch +imptcp-guard-regex-framing-match-at-line-start.patch +rainerscript-align-replace-sizing-rewind.patch +mmpstrucdata-Fix-stack-buffer-overflow-with-oversized-RFC.patch