1. CVE-Search
  2. CVE-2018-1000140
ID CVE-2018-1000140
Summary rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.
References
Vulnerable Configurations
  • cpe:2.3:a:rsyslog:librelp:0.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:0.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:0.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:0.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:0.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:0.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.1.4:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.1.5:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.1.5:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.2.5:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.2.7:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.2.7:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.2.8:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.2.8:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.2.9:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.2.9:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.2.10:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.2.10:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.2.11:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.2.11:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.2.12:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.2.12:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.2.13:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.2.13:*:*:*:*:*:*:*
  • cpe:2.3:a:rsyslog:librelp:1.2.14:*:*:*:*:*:*:*
    cpe:2.3:a:rsyslog:librelp:1.2.14:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:6.7:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_eus:6.7:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:6.6:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_tus:6.6:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 12-06-2023 - 07:15)
Impact:
Exploitability:
CWE CWE-787
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
redhat via4
advisories
  • bugzilla
    id 1560084
    title CVE-2018-1000140 librelp: Stack-based buffer overflow in relpTcpChkPeerName function in src/tcp.c
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 7 is installed
        oval oval:com.redhat.rhba:tst:20150364027
      • OR
        • AND
          • comment librelp is earlier than 0:1.2.12-1.el7_5.1
            oval oval:com.redhat.rhsa:tst:20181223001
          • comment librelp is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20181223002
        • AND
          • comment librelp-devel is earlier than 0:1.2.12-1.el7_5.1
            oval oval:com.redhat.rhsa:tst:20181223003
          • comment librelp-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20181223004
    rhsa
    id RHSA-2018:1223
    released 2018-04-24
    severity Critical
    title RHSA-2018:1223: librelp security update (Critical)
  • bugzilla
    id 1560084
    title CVE-2018-1000140 librelp: Stack-based buffer overflow in relpTcpChkPeerName function in src/tcp.c
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 6 is installed
        oval oval:com.redhat.rhba:tst:20111656003
      • OR
        • AND
          • comment librelp is earlier than 0:1.2.7-3.el6_9.1
            oval oval:com.redhat.rhsa:tst:20181225001
          • comment librelp is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20181223002
        • AND
          • comment librelp-devel is earlier than 0:1.2.7-3.el6_9.1
            oval oval:com.redhat.rhsa:tst:20181225003
          • comment librelp-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20181223004
    rhsa
    id RHSA-2018:1225
    released 2018-04-24
    severity Critical
    title RHSA-2018:1225: librelp security update (Critical)
  • rhsa
    id RHSA-2018:1701
  • rhsa
    id RHSA-2018:1702
  • rhsa
    id RHSA-2018:1703
  • rhsa
    id RHSA-2018:1704
  • rhsa
    id RHSA-2018:1707
rpms
  • librelp-0:1.2.12-1.el7_5.1
  • librelp-debuginfo-0:1.2.12-1.el7_5.1
  • librelp-devel-0:1.2.12-1.el7_5.1
  • librelp-0:1.2.7-3.el6_9.1
  • librelp-debuginfo-0:1.2.7-3.el6_9.1
  • librelp-devel-0:1.2.7-3.el6_9.1
  • librelp-0:1.2.7-3.el6_6.1
  • librelp-debuginfo-0:1.2.7-3.el6_6.1
  • librelp-devel-0:1.2.7-3.el6_6.1
  • librelp-0:1.2.7-3.el6_7.1
  • librelp-debuginfo-0:1.2.7-3.el6_7.1
  • librelp-devel-0:1.2.7-3.el6_7.1
  • librelp-0:1.2.0-4.el7_2
  • librelp-debuginfo-0:1.2.0-4.el7_2
  • librelp-devel-0:1.2.0-4.el7_2
  • librelp-0:1.2.12-1.el7_4.1
  • librelp-debuginfo-0:1.2.12-1.el7_4.1
  • librelp-devel-0:1.2.12-1.el7_4.1
  • librelp-0:1.2.0-4.el7_3
  • librelp-debuginfo-0:1.2.0-4.el7_3
  • librelp-devel-0:1.2.0-4.el7_3
refmap via4
debian DSA-4151
gentoo GLSA-201804-21
misc
ubuntu USN-3612-1
Last major update 12-06-2023 - 07:15
Published 23-03-2018 - 21:29
Last modified 12-06-2023 - 07:15
Back to Top