CVE-2013-4758
Double free vulnerability in the writeDataError function in the ElasticSearch plugin (omelasticsearch) in rsyslog before 7.4.2 and before 7.5.2 devel, when errorfile is set to local logging, allows remote attackers to cause a denial of service (crash)…
Does this matter?
Lower severity and a low EPSS score (2.33%). Track it; it rarely justifies an emergency change on its own.
Description
Double free vulnerability in the writeDataError function in the ElasticSearch plugin (omelasticsearch) in rsyslog before 7.4.2 and before 7.5.2 devel, when errorfile is set to local logging, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted JSON response.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 2.33% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-399
- Affected
- rsyslog/rsyslog
- Source
- cve@mitre.org
References
- http://www.openwall.com/lists/oss-security/2013/07/05/2
- http://www.rsyslog.com/rsyslog-7-4-2-v7-stable-released/Patch
- http://www.rsyslog.com/rsyslog-7-5-2-v7-devel-released/Patch
- http://www.openwall.com/lists/oss-security/2013/07/05/2
- http://www.rsyslog.com/rsyslog-7-4-2-v7-stable-released/Patch
- http://www.rsyslog.com/rsyslog-7-5-2-v7-devel-released/Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.