Syslog Ng

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:oneidentity:syslog-ng:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorOneidentity (9a4d59b1-0090-5ffc-a8b8-0160c7a2dcca)
ProductSyslog Ng (6c8faded-7c10-599f-ac54-28c76c28e4fa)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:deb/debian/syslog-ng purl2cpe 2026-06-01 10:11:09.006285
pkg:deb/ubuntu/syslog-ng purl2cpe 2026-06-01 10:11:09.006289
pkg:github/syslog-ng/syslog-ng purl2cpe 2026-06-01 10:11:09.006291
pkg:rpm/fedora/syslog-ng purl2cpe 2026-06-01 10:11:09.006294
pkg:rpm/opensuse/syslog-ng purl2cpe 2026-06-01 10:11:09.006297

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-47619 vulnerable 2026-06-08 06:48:12.952319 tranport: TLS host name wildcard matching too lax
HIGH (7.5)
syslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo.*.bar` although that is not allowed. It is also possible to pass partial wildcards such as `foo.a*c.bar` which glib matches but should be avoided / invalidated. This issue could have an impact on TLS connections, such as in man-in-the-middle situations. Version 4.8.2 contains a fix for the issue.
Published: 2025-05-07T15:12:02.118Z
Updated: 2025-05-28T10:03:45.900Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-8019 vulnerable 2026-06-08 05:27:14.677725 syslog-ng: Local privilege escalation from new to root in %post
HIGH (7.7)
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of syslog-ng of SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Module for Legacy Software 12, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server for SAP 12-SP1; openSUSE Backports SLE-15-SP1, openSUSE Leap 15.1 allowed local attackers controlling the user news to escalate their privileges to root. This issue affects: SUSE Linux Enterprise Debuginfo 11-SP3 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Debuginfo 11-SP4 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Module for Legacy Software 12 syslog-ng versions prior to 3.6.4-12.8.1. SUSE Linux Enterprise Point of Sale 11-SP3 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Server 11-SP4-LTSS syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Server for SAP 12-SP1 syslog-ng versions prior to 3.6.4-12.8.1. openSUSE Backports SLE-15-SP1 syslog-ng versions prior to 3.19.1-bp151.4.6.1. openSUSE Leap 15.1 syslog-ng versions prior to 3.19.1-lp151.3.6.1.
Published: 2020-06-29T11:30:14.396Z
Updated: 2024-09-17T03:43:09.266Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2011-1951 vulnerable 2026-06-08 04:58:03.318913 Details available
lib/logmatcher.c in Balabit syslog-ng before 3.2.4, when the global flag is set and when using PCRE 8.12 and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via a message that does not match a regular expression.
Published: 2011-07-11T20:00:00.000Z
Updated: 2024-08-06T22:46:00.752Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2008-5110 vulnerable 2026-06-08 04:50:49.640297 Details available
syslog-ng does not call chdir when it calls chroot, which might allow attackers to escape the intended jail. NOTE: this is only a vulnerability when a separate vulnerability is present. This flaw affects syslog-ng versions prior to and including 2.0.9.
Published: 2008-11-17T22:00:00.000Z
Updated: 2024-08-07T10:40:17.230Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.