VulnerabilityModified

CVE-2011-1489

MEDIUM 5.5EPSS 0.47%

Does this matter?

Lower severity and a low EPSS score (0.47%). Track it; it rarely justifies an emergency change on its own.

Description

A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages were logged when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could cause denial of the rsyslogd daemon service via a log message belonging to more than one ruleset.

CVSS 3.1: 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.47% probability · 40th percentile
CISA KEV: Not listed
Weakness: CWE-772
Affected: rsyslog/rsyslog · opensuse/opensuse · debian/debian linux
Source: secalert@redhat.com

References

http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00005.htmlMailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2011-1489Exploit, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1489Issue Tracking, Third Party Advisory
https://github.com/rsyslog/rsyslog/commit/1ef709cc97d54f74d3fdeb83788cc4b01f4c6a2aPatch, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-1489Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00005.htmlMailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2011-1489Exploit, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1489Issue Tracking, Third Party Advisory
https://github.com/rsyslog/rsyslog/commit/1ef709cc97d54f74d3fdeb83788cc4b01f4c6a2aPatch, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-1489Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.