Skip to content
Fencer Intel
critical 9.8

CVE-2019-17041 json

An issue was discovered in Rsyslog v8.1908.0.

published 7y ago modified 4mo ago also EUVD-2019-7515

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.4%
EPSS 4.4% chance of exploitation in 30 days, percentile 91%
public exploits
0
none known

Summary

An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow.

Patch / fix

  • rsyslog Debian 14, Debian 13, Debian 12 8.1910.0-1

debian advisories DEBIAN-CVE-2019-17041

  • rsyslog Ubuntu Pro 16.04 LTS 8.16.0-1ubuntu3.1+esm1

ubuntu advisories UBUNTU-CVE-2019-17041

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rsyslog RHEL 8 8.1911.0-3.el8
  • rsyslog-relp RHEL 8 8.1911.0-3.el8
  • rsyslog-snmp RHEL 8 8.1911.0-3.el8
  • rsyslog-kafka RHEL 8 8.1911.0-3.el8
  • rsyslog-mysql RHEL 8 8.1911.0-3.el8
  • rsyslog-pgsql RHEL 8 8.1911.0-3.el8
  • rsyslog-crypto RHEL 8 8.1911.0-3.el8
  • rsyslog-gnutls RHEL 8 8.1911.0-3.el8

red hat advisories RHSA-2020:1702RHSA-2020:1000

  • rsyslog SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +1 more 8.4.0-18.13.1
  • rsyslog SLE Module for Server Applications 15 SP1, SLE Module for Server Applications 15, SLE Module for Basesystem 15 SP1 +1 more 8.33.1-3.22.4
  • rsyslog SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +2 more 8.24.0-3.33.2
  • rsyslog SLES for SAP 12 SP1, SLES 12 SP1-LTSS 8.4.0-13.8.1

suse advisories SUSE-SU-2020:0512-1SUSE-SU-2020:0424-1SUSE-SU-2019:2937-1SUSE-RU-2019:2816-1

  • rsyslog openSUSE Leap 15.1 8.33.1-lp151.6.10.1
  • rsyslog openSUSE Leap 15.0 8.33.1-lp150.2.19.1

opensuse advisories openSUSE-SU-2019:2501-1openSUSE-SU-2019:2500-1

  • rsyslog Alpine 3.10 8.1904.0-r1
  • rsyslog Alpine 3.24, Alpine 3.23, Alpine 3.22 +11 more 8.1908.0-r1
  • rsyslog Alpine 3.7 8.31.0-r1
  • rsyslog Alpine 3.8 8.34.0-r1
  • rsyslog Alpine 3.9 8.40.0-r4

alpine advisories ALPINE-CVE-2019-17041

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2019-17041 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-17041 updated cvss 7.5

rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c

  • Red Hat Enterprise Linux 6 rsyslog7, rsyslog7-relp, rsyslog7-snmp, rsyslog7-mysql, rsyslog7-pgsql, rsyslog7-gnutls, +2 more
    affected: no fix planned “Out of support scope”
  • Red Hat Ansible Tower 3.5 for RHEL 7 Server ansible-tower-35/ansible-tower 3.5.6-1
    fixed: vendor fix RHBA-2020:1539
  • Red Hat Ansible Tower 3.6 for RHEL 7 ansible-tower-36/ansible-tower 3.6.4-1
    fixed: vendor fix RHBA-2020:1540
  • Red Hat Enterprise Linux AppStream (v. 8) rsyslog 8.1911.0-3.el8, rsyslog-relp 8.1911.0-3.el8, rsyslog-snmp 8.1911.0-3.el8, rsyslog-kafka 8.1911.0-3.el8, rsyslog-mysql 8.1911.0-3.el8, rsyslog-pgsql 8.1911.0-3.el8, +9 more
    fixed: vendor fix RHSA-2020:1702
  • Red Hat Enterprise Linux Client (v. 7) rsyslog 8.24.0-52.el7, rsyslog-relp 8.24.0-52.el7, rsyslog-kafka 8.24.0-52.el7, rsyslog-gnutls 8.24.0-52.el7, rsyslog-gssapi 8.24.0-52.el7, rsyslog-mmjsonparse 8.24.0-52.el7 Red Hat Enterprise Linux Client Optional (v. 7) rsyslog-snmp 8.24.0-52.el7, rsyslog-mysql 8.24.0-52.el7, rsyslog-pgsql 8.24.0-52.el7, rsyslog-crypto 8.24.0-52.el7, rsyslog-libdbi 8.24.0-52.el7, rsyslog-mmaudit 8.24.0-52.el7, +5 more Red Hat Enterprise Linux ComputeNode (v. 7) rsyslog 8.24.0-52.el7, rsyslog-relp 8.24.0-52.el7, rsyslog-kafka 8.24.0-52.el7, rsyslog-gnutls 8.24.0-52.el7, rsyslog-gssapi 8.24.0-52.el7, rsyslog-mmjsonparse 8.24.0-52.el7 Red Hat Enterprise Linux ComputeNode Optional (v. 7) rsyslog-snmp 8.24.0-52.el7, rsyslog-mysql 8.24.0-52.el7, rsyslog-pgsql 8.24.0-52.el7, rsyslog-crypto 8.24.0-52.el7, rsyslog-libdbi 8.24.0-52.el7, rsyslog-mmaudit 8.24.0-52.el7, +5 more Red Hat Enterprise Linux Server (v. 7) rsyslog 8.24.0-52.el7, rsyslog-relp 8.24.0-52.el7, rsyslog-kafka 8.24.0-52.el7, rsyslog-mysql 8.24.0-52.el7, rsyslog-pgsql 8.24.0-52.el7, rsyslog-gnutls 8.24.0-52.el7, +2 more Red Hat Enterprise Linux Server Optional (v. 7) rsyslog-snmp 8.24.0-52.el7, rsyslog-crypto 8.24.0-52.el7, rsyslog-libdbi 8.24.0-52.el7, rsyslog-mmaudit 8.24.0-52.el7, rsyslog-udpspoof 8.24.0-52.el7, rsyslog-mmjsonparse 8.24.0-52.el7, +4 more
    +2 more products
    Red Hat Enterprise Linux Workstation (v. 7) rsyslog 8.24.0-52.el7, rsyslog-relp 8.24.0-52.el7, rsyslog-kafka 8.24.0-52.el7, rsyslog-mysql 8.24.0-52.el7, rsyslog-pgsql 8.24.0-52.el7, rsyslog-gnutls 8.24.0-52.el7, +2 more Red Hat Enterprise Linux Workstation Optional (v. 7) rsyslog-snmp 8.24.0-52.el7, rsyslog-crypto 8.24.0-52.el7, rsyslog-libdbi 8.24.0-52.el7, rsyslog-mmaudit 8.24.0-52.el7, rsyslog-udpspoof 8.24.0-52.el7, rsyslog-mmnormalize 8.24.0-52.el7, +3 more
    fixed: vendor fix RHSA-2020:1000
  • Red Hat Enterprise Linux 5 rsyslog, rsyslog5 Red Hat Enterprise Linux 6 rsyslog, rsyslog-relp, rsyslog-snmp, rsyslog-mysql, rsyslog-pgsql, rsyslog-gnutls, +1 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

4.45% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.