Debian Bug report logs - #1120690
bookworm-pu: package syslog-ng/3.38.1-5+deb12u1

Reply or subscribe to this bug.

Display info messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Jochen Sprickerhof <jspricke@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: bookworm-pu: package syslog-ng/3.38.1-5+deb12u1

Date: Fri, 14 Nov 2025 19:43:11 +0100

[Message part 1 (text/plain, inline)]

Package: release.debian.org
Severity: normal
Tags: bookworm
X-Debbugs-Cc: syslog-ng@packages.debian.org
Control: affects -1 + src:syslog-ng
User: release.debian.org@packages.debian.org
Usertags: pu

[ Reason ]
This fixes CVE-2024-47619 in bookworm. It was tagged no-dsa but would be
still good to have fixed as it was fixed in older and newer releases.

[ Impact ]
Wildcard hostnames are not correctly checked in TLS certificates. Also
This would be a regression for users upgrading from older releases.

[ Tests ]
There are a number of new unit tests from the upstream commit and I ran
autopkgtest and other tests.

[ Risks ]
Low, the same patch is already rolled out in older releases and only
modifies one specific function. Given that TLS certificates are
regularly rotated anyway I expect stricter checks to be useful.

[ Checklist ]
  [X] *all* changes are documented in the d/changelog
  [X] I reviewed all changes and I approve them
  [X] attach debdiff against the package in (old)stable
  [X] the issue is verified as fixed in unstable

[ Changes ]
The hostname check is extended to catch more invalid cases and how
special characters are treated. Also a number of unit tests are added.

[syslog-ng.patch (text/plain, attachment)]

Message #12 received at 1120690@bugs.debian.org (full text, mbox, reply):

From: Adam D Barratt <adam@adam-barratt.org.uk>

To: 1120690@bugs.debian.org

Cc: 1120690-submitter@bugs.debian.org

Subject: syslog-ng 3.38.1-5+deb12u1 flagged for acceptance

Date: Sat, 06 Dec 2025 11:38:58 +0000

package release.debian.org
tags 1120690 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==============

Package: syslog-ng
Version: 3.38.1-5+deb12u1

Explanation: fix incorrect wildcard matching in certificate names [CVE-2024-47619]

Send a report that this bug log contains spam.