The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1817-1 advisory.

    - CVE-2022-24903: Fixed potential heap buffer overflow in modules for TCP syslog reception (bsc#1199061).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:4799 advisory.

    The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC     3195, permitted sender lists, filtering on any message part, and fine-grained control over output format.

    Security Fix(es):

    * rsyslog: Heap-based overflow in TCP syslog server (CVE-2022-24903)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-4803 advisory.

    [8.24.0-57.0.4.el7_9.3]
    - Newer gcc complains about implicit declaration of prctl. Added header file to quiesce the compiler

    [8.24.0-57.3]
    - Address CVE-2022-24903, Heap-based overflow in TCP syslog server       resolves: rhbz#2081395

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:4799 advisory.

  - Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap     buffer overflow when octet-counted framing is used. This can result in a segfault or some other     malfunction. As of our understanding, this vulnerability can not be used for remote code execution. But     there may still be a slight chance for experts to do that. The bug occurs when the octet count is read.
    While there is a check for the maximum number of octets, digits are written to a heap buffer even when the     octet count is over the maximum, This can be used to overrun the memory buffer. However, once the sequence     of digits stop, no additional characters can be added to the buffer. In our opinion, this makes remote     exploits impossible or at least highly complex. Octet-counted framing is one of two potential framing     modes. It is relatively uncommon, but enabled by default on receivers. Modules `imtcp`, `imptcp`,     `imgssapi`, and `imhttp` are used for regular syslog message reception. It is best practice not to     directly expose them to the public. When this practice is followed, the risk is considerably lower. Module     `imdiag` is a diagnostics module primarily intended for testbench runs. We do not expect it to be present     on any production installation. Octet-counted framing is not very common. Usually, it needs to be     specifically enabled at senders. If users do not need it, they can turn it off for the most important     modules. This will mitigate the vulnerability. (CVE-2022-24903)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the rsyslog packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap     buffer overflow when octet-counted framing is used. This can result in a segfault or some other     malfunction. As of our understanding, this vulnerability can not be used for remote code execution. But     there may still be a slight chance for experts to do that. The bug occurs when the octet count is read.
    While there is a check for the maximum number of octets, digits are written to a heap buffer even when the     octet count is over the maximum, This can be used to overrun the memory buffer. However, once the sequence     of digits stop, no additional characters can be added to the buffer. In our opinion, this makes remote     exploits impossible or at least highly complex. Octet-counted framing is one of two potential framing     modes. It is relatively uncommon, but enabled by default on receivers. Modules `imtcp`, `imptcp`,     `imgssapi`, and `imhttp` are used for regular syslog message reception. It is best practice not to     directly expose them to the public. When this practice is followed, the risk is considerably lower. Module     `imdiag` is a diagnostics module primarily intended for testbench runs. We do not expect it to be present     on any production installation. Octet-counted framing is not very common. Usually, it needs to be     specifically enabled at senders. If users do not need it, they can turn it off for the most important     modules. This will mitigate the vulnerability. (CVE-2022-24903)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-f2c4c83cc1 advisory.

    Automatic update for rsyslog-8.2204.0-1.fc37.

    ##### **Changelog**

    ```
    * Mon May  9 2022 Attila Lakatos <alakatos@redhat.com> - 8.2204.0-1
    - rebase to 8.2204.0       resolves: rhbz#1951970
    - CVE-2022-24903 rsyslog: Heap-based overflow in TCP syslog server       resolves: rhbz#2082302

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3666:04 advisory.

    * rsyslog: Heap-based overflow in TCP syslog server (CVE-2022-24903)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2022:0137 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2022-24903:
    Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap     buffer overflow when octet-counted framing is used. This can result in a segfault or some other     malfunction. As of our understanding, this vulnerability can not be used for remote code execution. But     there may still be a slight chance for experts to do that. The bug occurs when the octet count is read.
    While there is a check for the maximum number of octets, digits are written to a heap buffer even when the     octet count is over the maximum, This can be used to overrun the memory buffer. However, once the sequence     of digits stop, no additional characters can be added to the buffer. In our opinion, this makes remote     exploits impossible or at least highly complex. Octet-counted framing is one of two potential framing     modes. It is relatively uncommon, but enabled by default on receivers. Modules `imtcp`, `imptcp`,     `imgssapi`, and `imhttp` are used for regular syslog message reception. It is best practice not to     directly expose them to the public. When this practice is followed, the risk is considerably lower. Module     `imdiag` is a diagnostics module primarily intended for testbench runs. We do not expect it to be present     on any production installation. Octet-counted framing is not very common. Usually, it needs to be     specifically enabled at senders. If users do not need it, they can turn it off for the most important     modules. This will mitigate the vulnerability.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3197:02 advisory.

    * rsyslog: Heap-based overflow in TCP syslog server (CVE-2022-24903)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:4896 advisory.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include     redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH)     are installed using a special build of Red Hat Enterprise Linux with only the packages required to host     virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and     performing administrative tasks.

    Security Fix(es):

    * kernel: use-after-free in RDMA listen() (CVE-2021-4028)

    * kernel: fget: check that the fd still exists after getting a ref to it (CVE-2021-4083)

    * kernel: heap out of bounds write in nf_dup_netdev.c (CVE-2022-25636)

    * openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778)

    * zlib: A flaw found in zlib when compressing (not decompressing) certain inputs (CVE-2018-25032)

    * gzip: arbitrary-file-write vulnerability (CVE-2022-1271)

    * rsyslog: Heap-based overflow in TCP syslog server (CVE-2022-24903)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fixes:

    * elfutils package has been update within RHV-H Channel to match the same version released in RHEL     (BZ#2038081)

    * Rebase package(s) to version 1.2.24     For highlights, important fixes, or notable enhancements: see bugs in Depend On. (BZ#2057338)

    * Rebase package(s) to version: 4.5.0

    Highlights, important fixes, or notable enhancements: (BZ#2057342)

    * Rebase package(s) to version anaconda-33.16.6.6-1.el8     For highlights and important bug fixes: include UI change for blocking installation if root password is     not set. (BZ#1899821)

    * Red hat Virtualization Host has been rebased on Red Hat Enterprise Linux 8.6 (BZ#1997074)

    * Previously, concurrent executions of LV refresh (lvchange) failed. This hindered simultaneous starts of     virtual machines that have thin-provisioned disks based on the same disk on a block storage domain.
    In this release, concurrent execution of LV refresh has been fixed in LVM2. (BZ#2020497)

    * Red Hat Virtualization Host has been rebased on latest Ceph 4.3 (BZ#2090138)

    * In previous releases systemtap package could have been installed on top of RHV-H from RHV-H channel.
    With 4.4 SP1 systemtap package installation is not supported anymore (BZ#2052963)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1510 advisory.

    This advisory aggregates security fixes for the rsyslog SRPM in CIQ LTS 8.6. It addresses 2 CVEs:
    CVE-2022-24903, CVE-2026-78002.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
161470	SUSE SLES15: rsyslog / rsyslog-module-gssapi / rsyslog-module-gtls / etc (SUSE-SU-2022:1817-1)	Nessus	SuSE Local Security Checks	2022/5/24	2026/6/26	high
161675	RHEL 8 : rsyslog (RHSA-2022:4799)	Nessus	Red Hat Local Security Checks	2022/5/30	2024/11/7	high
161722	Oracle Linux 7 : rsyslog (ELSA-2022-4803)	Nessus	Oracle Linux Local Security Checks	2022/5/31	2024/11/1	high
161901	AlmaLinux 8 : rsyslog (ALSA-2022:4799)	Nessus	Alma Linux Local Security Checks	2022/6/6	2022/6/6	high
175197	EulerOS Virtualization 3.0.2.0 : rsyslog (EulerOS-SA-2023-1692)	Nessus	Huawei Local Security Checks	2023/5/7	2023/5/7	high
210975	Fedora 37 : rsyslog (2022-f2c4c83cc1)	Nessus	Fedora Local Security Checks	2024/11/14	2024/11/14	high
293032	MiracleLinux 8 : rsyslog-8.2102.0-7.el8.1 (AXSA:2022-3666:04)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
236533	Alibaba Cloud Linux 3 : 0137: rsyslog (ALINUX3-SA-2022:0137)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
294551	MiracleLinux 7 : rsyslog-8.24.0-57.el7.3 (AXSA:2022-3197:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
161818	RHEL 8 : Red Hat Virtualization security, update [ovirt-4.5.0] (Important) (RHSA-2022:4896)	Nessus	Red Hat Local Security Checks	2022/6/3	2026/1/21	high
355410	Rocky Linux 8.6 [CIQ] Security Update: rsyslog / rsyslog-crypto / rsyslog-doc / rsyslog-elasticsearch / etc Multiple Vulnerabilities (ciqsa-2026_1510)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high