[Buildroot] [PATCH] package/syslog-ng: security bump to v4.8.3
Titouan Christophe
titouan.christophe at mind.be
Tue Sep 23 13:18:05 UTC 2025
See the release notes:
- https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.8.2
- https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.8.3
This fixes the following vulnerability:
- CVE-2024-47619:
syslog-ng is an enhanced log daemo. Prior to version 4.8.2,
`tls_wildcard_match()` matches on certificates such as `foo.*.bar`
although that is not allowed. It is also possible to pass partial
wildcards such as `foo.a*c.bar` which glib matches but should be
avoided / invalidated. This issue could have an impact on TLS
connections, such as in man-in-the-middle situations. Version 4.8.2
contains a fix for the issue.
https://www.cve.org/CVERecord?id=CVE-2024-47619
Signed-off-by: Titouan Christophe <titouan.christophe at mind.be>
---
package/syslog-ng/syslog-ng.hash | 2 +-
package/syslog-ng/syslog-ng.mk | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/package/syslog-ng/syslog-ng.hash b/package/syslog-ng/syslog-ng.hash
index 4ca6a3e33e..04f33926d5 100644
--- a/package/syslog-ng/syslog-ng.hash
+++ b/package/syslog-ng/syslog-ng.hash
@@ -1,5 +1,5 @@
# Locally computed
-sha256 e8b8b98c60a5b68b25e3462c4104c35d05b975e6778d38d8a81b8ff7c0e64c5b syslog-ng-4.8.1.tar.gz
+sha256 f82732a8e639373037d2b69c0e6d5d6594290f0350350f7a146af4cd8ab9e2c7 syslog-ng-4.8.3.tar.gz
sha256 d7d51f8d0f6ee9757a371080e7f5fa19ac73afbef14db6e981705cf1ec813d6b COPYING
sha256 ce3324c9f22299cfc7c281e5a6ab40fbe9c2ea1a67cee87226cb8cd39db1e1d2 GPL.txt
sha256 dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551 LGPL.txt
diff --git a/package/syslog-ng/syslog-ng.mk b/package/syslog-ng/syslog-ng.mk
index 6f608eed0d..fa405ca5cb 100644
--- a/package/syslog-ng/syslog-ng.mk
+++ b/package/syslog-ng/syslog-ng.mk
@@ -6,7 +6,7 @@
# When updating the version, please check at runtime if the version in
# syslog-ng.conf header needs to be updated
-SYSLOG_NG_VERSION = 4.8.1
+SYSLOG_NG_VERSION = 4.8.3
SYSLOG_NG_SITE = https://github.com/balabit/syslog-ng/releases/download/syslog-ng-$(SYSLOG_NG_VERSION)
SYSLOG_NG_LICENSE = LGPL-2.1+ (syslog-ng core), GPL-2.0+ (modules)
SYSLOG_NG_LICENSE_FILES = COPYING GPL.txt LGPL.txt
--
2.51.0
More information about the buildroot
mailing list