{"id":"CVE-2018-1000140","aliases":["DEBIAN-CVE-2018-1000140","DSA-4151-1","EUVD-2018-1858","GHSA-m73v-c2p6-943p","MGASA-2018-0251","RHSA-2018:1223","RHSA-2018:1225","RHSA-2018:1701","RHSA-2018:1702","RHSA-2018:1703","RHSA-2018:1704","RHSA-2018:1707","SUSE-SU-2018:0822-1","SUSE-SU-2018:0828-1","SUSE-SU-2022:1891-1","UBUNTU-CVE-2018-1000140","USN-3612-1","USN-4828-1","openSUSE-SU-2024:10982-1"],"status":"published","title":"rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the...","description":"rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.09342,"percentile":0.95419,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-787"],"published":"2018-03-23T00:00:00Z","modified":"2026-10-23T18:03:17Z","exploits":[{"source":"pocgithub","id":"s0/rsyslog-librelp-CVE-2018-1000140","title":"s0/rsyslog-librelp-CVE-2018-1000140","date":"2019-05-14","url":"https://github.com/s0/rsyslog-librelp-CVE-2018-1000140"},{"source":"pocgithub","id":"s0/rsyslog-librelp-CVE-2018-1000140-fixed","title":"s0/rsyslog-librelp-CVE-2018-1000140-fixed","date":"2019-05-14","url":"https://github.com/s0/rsyslog-librelp-CVE-2018-1000140-fixed"}],"fixes":[{"ecosystem":"Debian:12","package":"librelp","fixed_in":["1.2.15-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"librelp","fixed_in":["1.2.15-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"librelp","fixed_in":["1.2.15-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"librelp","fixed_in":["1.2.7-2+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"librelp","fixed_in":["1.2.12-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"librelp","fixed_in":["1.2.7-3.1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"librelp","fixed_in":["1.2.13-1.1.mga6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"librelp","fixed_in":["0:1.2.12-1.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"librelp-debuginfo","fixed_in":["0:1.2.12-1.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"librelp-devel","fixed_in":["0:1.2.12-1.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"librelp","fixed_in":["0:1.2.12-1.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"librelp-debuginfo","fixed_in":["0:1.2.12-1.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"librelp-devel","fixed_in":["0:1.2.12-1.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"librelp","fixed_in":["0:1.2.12-1.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"librelp-debuginfo","fixed_in":["0:1.2.12-1.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"librelp-devel","fixed_in":["0:1.2.12-1.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"librelp","fixed_in":["0:1.2.12-1.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"librelp-debuginfo","fixed_in":["0:1.2.12-1.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"librelp-devel","fixed_in":["0:1.2.12-1.el7_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"librelp","fixed_in":["0:1.2.7-3.el6_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"librelp-debuginfo","fixed_in":["0:1.2.7-3.el6_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"librelp-devel","fixed_in":["0:1.2.7-3.el6_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"librelp","fixed_in":["0:1.2.7-3.el6_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"librelp-debuginfo","fixed_in":["0:1.2.7-3.el6_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"librelp-devel","fixed_in":["0:1.2.7-3.el6_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"librelp","fixed_in":["0:1.2.7-3.el6_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"librelp-debuginfo","fixed_in":["0:1.2.7-3.el6_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"librelp-devel","fixed_in":["0:1.2.7-3.el6_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"librelp","fixed_in":["0:1.2.7-3.el6_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"librelp-debuginfo","fixed_in":["0:1.2.7-3.el6_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"librelp-devel","fixed_in":["0:1.2.7-3.el6_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:6.6::server","package":"librelp","fixed_in":["0:1.2.7-3.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:6.6::server","package":"librelp-debuginfo","fixed_in":["0:1.2.7-3.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:6.6::server","package":"librelp","fixed_in":["0:1.2.7-3.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:6.6::server","package":"librelp-debuginfo","fixed_in":["0:1.2.7-3.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:6.6::server","package":"librelp-devel","fixed_in":["0:1.2.7-3.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:6.6::server","package":"librelp-devel","fixed_in":["0:1.2.7-3.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.7::computenode","package":"librelp","fixed_in":["0:1.2.7-3.el6_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.7::computenode","package":"librelp-debuginfo","fixed_in":["0:1.2.7-3.el6_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.7::computenode","package":"librelp-devel","fixed_in":["0:1.2.7-3.el6_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.7::server","package":"librelp","fixed_in":["0:1.2.7-3.el6_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.7::server","package":"librelp-debuginfo","fixed_in":["0:1.2.7-3.el6_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:6.7::server","package":"librelp-devel","fixed_in":["0:1.2.7-3.el6_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:7.2::server","package":"librelp","fixed_in":["0:1.2.0-4.el7_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:7.2::server","package":"librelp-debuginfo","fixed_in":["0:1.2.0-4.el7_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:7.2::server","package":"librelp","fixed_in":["0:1.2.0-4.el7_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:7.2::server","package":"librelp-debuginfo","fixed_in":["0:1.2.0-4.el7_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:7.2::server","package":"librelp","fixed_in":["0:1.2.0-4.el7_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:7.2::server","package":"librelp-debuginfo","fixed_in":["0:1.2.0-4.el7_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:7.2::server","package":"librelp-devel","fixed_in":["0:1.2.0-4.el7_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:7.2::server","package":"librelp-devel","fixed_in":["0:1.2.0-4.el7_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:7.2::server","package":"librelp-devel","fixed_in":["0:1.2.0-4.el7_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.4::computenode","package":"librelp","fixed_in":["0:1.2.12-1.el7_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.4::computenode","package":"librelp-debuginfo","fixed_in":["0:1.2.12-1.el7_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.4::computenode","package":"librelp-devel","fixed_in":["0:1.2.12-1.el7_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.4::server","package":"librelp","fixed_in":["0:1.2.12-1.el7_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.4::server","package":"librelp-debuginfo","fixed_in":["0:1.2.12-1.el7_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.4::server","package":"librelp-devel","fixed_in":["0:1.2.12-1.el7_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.3::computenode","package":"librelp","fixed_in":["0:1.2.0-4.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.3::computenode","package":"librelp-debuginfo","fixed_in":["0:1.2.0-4.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.3::computenode","package":"librelp-devel","fixed_in":["0:1.2.0-4.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.3::server","package":"librelp","fixed_in":["0:1.2.0-4.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.3::server","package":"librelp-debuginfo","fixed_in":["0:1.2.0-4.el7_3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.3::server","package":"librelp-devel","fixed_in":["0:1.2.0-4.el7_3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"librelp","fixed_in":["1.2.12-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"librelp","fixed_in":["1.2.12-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"librelp","fixed_in":["1.2.12-3.3.1","1.2.15-3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 6","package":"librelp","fixed_in":["1.2.7-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"librelp","fixed_in":["1.2.7-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"librelp","fixed_in":["1.2.7-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"librelp","fixed_in":["1.2.7-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"librelp","fixed_in":["1.2.7-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"librelp","fixed_in":["1.2.7-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"librelp","fixed_in":["1.2.7-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"librelp","fixed_in":["1.2.7-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"librelp","fixed_in":["1.2.15-3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"librelp","fixed_in":["1.2.15-3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"librelp","fixed_in":["1.2.15-3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"librelp","fixed_in":["1.2.15-3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"librelp","fixed_in":["1.2.15-3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"librelp","fixed_in":["1.2.15-3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"librelp","fixed_in":["1.2.15-3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"librelp","fixed_in":["1.2.15-3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"librelp","fixed_in":["1.2.15-3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"librelp","fixed_in":["1.2.15-3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"librelp","fixed_in":["1.2.15-3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"librelp","fixed_in":["1.2.15-3.6.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"librelp","fixed_in":["1.2.2-2ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"librelp","fixed_in":["1.2.9-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"librelp","fixed_in":["1.2.14-3ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7-2+deb8u1"}]}],"versions":["1.2.7-2"]},{"source":"osv","ecosystem":"Debian:9","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-1+deb9u1"}]}],"versions":["1.2.12-1"]},{"source":"osv","ecosystem":"Mageia:5","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7-3.1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13-1.1.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.12-1.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"librelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.12-1.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"librelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.12-1.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.12-1.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"librelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.12-1.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"librelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.12-1.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.12-1.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"librelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.12-1.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"librelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.12-1.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.12-1.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"librelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.12-1.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"librelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.12-1.el7_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"librelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"librelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"librelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"librelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"librelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"librelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"librelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"librelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:6.6::server","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:6.6::server","package":"librelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:6.6::server","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:6.6::server","package":"librelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:6.6::server","package":"librelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:6.6::server","package":"librelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.7::computenode","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.7::computenode","package":"librelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.7::computenode","package":"librelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.7::server","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.7::server","package":"librelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.7::server","package":"librelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.7-3.el6_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:7.2::server","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-4.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:7.2::server","package":"librelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-4.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:7.2::server","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-4.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:7.2::server","package":"librelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-4.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:7.2::server","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-4.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:7.2::server","package":"librelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-4.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:7.2::server","package":"librelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-4.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:7.2::server","package":"librelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-4.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:7.2::server","package":"librelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-4.el7_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.4::computenode","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.12-1.el7_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.4::computenode","package":"librelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.12-1.el7_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.4::computenode","package":"librelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.12-1.el7_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.4::server","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.12-1.el7_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.4::server","package":"librelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.12-1.el7_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.4::server","package":"librelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.12-1.el7_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.3::computenode","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-4.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.3::computenode","package":"librelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-4.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.3::computenode","package":"librelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-4.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.3::server","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-4.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.3::server","package":"librelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-4.el7_3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.3::server","package":"librelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-4.el7_3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.12-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.15-3.6.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-2ubuntu1.1"}]}],"versions":["1.1.4-1","1.2.0-1","1.2.0-1ubuntu1","1.2.2-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-1ubuntu0.1~esm1"}]}],"versions":["1.2.7-3","1.2.8-1","1.2.9-1","1.2.9-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.14-3ubuntu0.1~esm1"}]}],"versions":["1.2.14-2","1.2.14-3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-2ubuntu1.1"}]}],"versions":["1.1.4-1","1.2.0-1","1.2.0-1ubuntu1","1.2.2-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-1ubuntu0.1~esm1"}]}],"versions":["1.2.7-3","1.2.8-1","1.2.9-1","1.2.9-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"librelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.14-3ubuntu0.1~esm1"}]}],"versions":["1.2.14-2","1.2.14-3"]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_eus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"rsyslog","product":"librelp"}],"references":[{"url":"https://usn.ubuntu.com/3612-1/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201804-21","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/rsyslog/librelp/blob/532aa362f0f7a8d037505b0a27a1df452f9bac9e/src/tcp.c#L1205","tags":["x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1703","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1704","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1702","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1225","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1707","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lgtm.com/rules/1505913226124/","tags":["x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1223","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4151","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1701","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/172829/librelp-Remote-Code-Execution.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000140","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m73v-c2p6-943p"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1000140","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0251.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22822","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2018/03/23/1","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1560084","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1223.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000140","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000140","tags":["advisory","report"]},{"url":"https://www.rsyslog.com/cve-2018-1000140/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1225.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1701.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1702.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1703.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1704.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1707.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180822-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1086730","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000140","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180828-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221891-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-1000140","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3612-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4828-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-1000140","description":"rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.","status":"published","published":"2018-03-23T00:00:00Z","modified":"2024-08-05T12:33:49.313Z","updated_at":"2026-11-02T14:35:10.685174Z"}],"euvd":[{"id":"EUVD-2018-1858","description":"rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.","status":"published","published":"2018-03-23T00:00:00Z","modified":"2024-08-05T12:33:49Z","updated_at":"2026-11-03T02:39:26.824954Z"}],"ghsa":[{"id":"GHSA-m73v-c2p6-943p","title":"rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the...","description":"rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.","status":"published","published":"2022-05-13T01:18:45Z","modified":"2023-06-12T09:30:18Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:54:38.89081Z"}],"nvd":[{"id":"CVE-2018-1000140","description":"rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.","status":"published","published":"2018-03-23T21:29:00.647Z","modified":"2026-06-17T01:32:30.977Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:04:24.264003Z"}],"osv":[{"id":"CVE-2018-1000140","description":"rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.","status":"published","published":"2018-03-23T21:29:00.647Z","modified":"2026-10-20T10:49:38.92256072Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"DEBIAN-CVE-2018-1000140","description":"rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.","status":"published","published":"2018-03-23T21:29:00.647Z","modified":"2026-10-23T18:03:17.981463117Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"RHSA-2018:1223","title":"Red Hat Security Advisory: librelp security update","status":"published","published":"2024-09-16T01:04:40Z","modified":"2026-06-26T10:37:07Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:1225","title":"Red Hat Security Advisory: librelp security update","status":"published","published":"2024-09-16T01:04:46Z","modified":"2026-06-26T10:37:08Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:1701","title":"Red Hat Security Advisory: librelp security update","status":"published","published":"2024-09-16T01:05:23Z","modified":"2026-06-26T12:22:07.382878199Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:1702","title":"Red Hat Security Advisory: librelp security update","status":"published","published":"2024-09-16T01:05:15Z","modified":"2026-06-26T10:37:47Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:1703","title":"Red Hat Security Advisory: librelp security update","status":"published","published":"2024-09-16T01:05:07Z","modified":"2026-06-26T12:22:07.402739496Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:1704","title":"Red Hat Security Advisory: librelp security update","status":"published","published":"2024-09-16T01:04:53Z","modified":"2026-06-26T10:37:48Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:1707","title":"Red Hat Security Advisory: librelp security update","status":"published","published":"2024-09-16T01:04:58Z","modified":"2026-06-26T10:37:49Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"UBUNTU-CVE-2018-1000140","description":"rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.","status":"published","published":"2018-03-23T00:00:00Z","modified":"2026-04-22T11:34:54.963094Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"DSA-4151-1","title":"librelp - security update","status":"published","published":"2018-03-26T00:00:00Z","modified":"2026-03-09T01:22:27.788987Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2018-0251","title":"Updated librelp packages fix security vulnerability","description":"librelp version 1.2.14 and earlier contains a Buffer Overflow\nvulnerability in the checking of x509 certificates from a peer that can\nresult in Remote code execution. This attack appear to be exploitable a\nremote attacker that can connect to rsyslog and trigger a stack buffer\noverflow by sending a specially crafted x509 certificate\n(CVE-2018-1000140).\n","status":"published","published":"2018-05-19T20:56:45Z","modified":"2026-04-16T06:25:19.46935783Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:10982-1","title":"librelp-devel-1.10.0-1.5 on GA media","description":"These are all security issues fixed in the librelp-devel-1.10.0-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:38:23.812126Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2018:0822-1","title":"Security update for librelp","description":"This update for librelp fixes the following issues:\n  CVE-2018-1000140 (bsc#1086730):\n  librelp contained a stack-based buffer overflow in the checking of x509 certificates.\n  A remote attacker with an access to the rsyslog logging facility could have exploited\n  it by sending a specially crafted x509 certificate.\n","status":"published","published":"2018-03-26T22:37:06Z","modified":"2026-02-04T03:00:14.926566Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:0828-1","title":"Security update for librelp","description":"This update for librelp fixes the following issues:\n\n  CVE-2018-1000140 (bsc#1086730):\n  librelp contained a stack-based buffer overflow in the checking of x509 certificates.\n  A remote attacker with an access to the rsyslog logging facility could have exploited\n  it by sending a specially crafted x509 certificate.\n","status":"published","published":"2018-03-27T11:26:12Z","modified":"2026-02-04T04:40:30.513646Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2022:1891-1","title":"Security update for librelp","description":"This update for librelp fixes the following issues:\n\n- CVE-2018-1000140: Fixed remote attack via specially crafted x509 certificates when connecting to rsyslog to trigger a stack buffer overflow and run arbitrary code (bsc#1086730).\n","status":"published","published":"2022-05-31T10:32:08Z","modified":"2026-02-04T03:43:14.136735Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-3612-1","title":"librelp vulnerability","description":"Bas van Schaik and Kevin Backhouse discovered that librelp incorrectly\nhandled checking certain x509 certificates. A remote attacker able to\nconnect to rsyslog could possibly use this issue to execute arbitrary code.\n","status":"published","published":"2018-03-28T17:58:28Z","modified":"2026-04-22T09:44:45.326357Z","updated_at":"2026-11-02T16:58:13.496563Z"},{"id":"USN-4828-1","title":"librelp vulnerability","description":"It was discovered that librelp did not properly manage x509 certificates,\nleading to a stack-based buffer overflow. A remote attacker could possibly\nuse this issue to execute arbitrary code.\n","status":"published","published":"2021-03-15T22:11:40Z","modified":"2026-06-25T13:30:30.679213274Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}