CVE-2018-16881 Denial of service in rsyslog:
An attacker can crash the rsyslog service by sending a specially crafted message to the imptcp socket, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-16881?
CVE-2018-16881 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 25 Jan 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which would cause rsyslog to crash. Versions before 8.27.0 are vulnerable.
Weakness: CWE-190
Which versions are affected by CVE-2018-16881?
It affects 12 products.
Linux distribution packages (40)
rsyslog Red Hat:enterprise_linux:7::client | All versions | 0:8.24.0-38.el7 |
rsyslog-crypto Red Hat:enterprise_linux:7::client | All versions | 0:8.24.0-38.el7 |
rsyslog-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:8.24.0-38.el7 |
rsyslog-doc Red Hat:enterprise_linux:7::client | All versions | 0:8.24.0-38.el7 |
rsyslog-elasticsearch Red Hat:enterprise_linux:7::client | All versions | 0:8.24.0-38.el7 |
rsyslog-gnutls Red Hat:enterprise_linux:7::client | All versions | 0:8.24.0-38.el7 |
rsyslog-gssapi Red Hat:enterprise_linux:7::client | All versions | 0:8.24.0-38.el7 |
rsyslog-kafka Red Hat:enterprise_linux:7::client | All versions | 0:8.24.0-38.el7 |
rsyslog-libdbi Red Hat:enterprise_linux:7::client | All versions | 0:8.24.0-38.el7 |
rsyslog-mmaudit Red Hat:enterprise_linux:7::client | All versions | 0:8.24.0-38.el7 |
rsyslog-mmjsonparse Red Hat:enterprise_linux:7::client | All versions | 0:8.24.0-38.el7 |
rsyslog-mmkubernetes Red Hat:enterprise_linux:7::client | All versions | 0:8.24.0-38.el7 |
rsyslog-mmnormalize Red Hat:enterprise_linux:7::client | All versions | 0:8.24.0-38.el7 |
rsyslog-mmsnmptrapd Red Hat:enterprise_linux:7::client | All versions | 0:8.24.0-38.el7 |
rsyslog-mysql Red Hat:enterprise_linux:7::client | All versions | 0:8.24.0-38.el7 |
rsyslog-pgsql Red Hat:enterprise_linux:7::client | All versions | 0:8.24.0-38.el7 |
rsyslog-relp Red Hat:enterprise_linux:7::client | All versions | 0:8.24.0-38.el7 |
rsyslog-snmp Red Hat:enterprise_linux:7::client | All versions | 0:8.24.0-38.el7 |
rsyslog-udpspoof Red Hat:enterprise_linux:7::client | All versions | 0:8.24.0-38.el7 |
rsyslog Red Hat:enterprise_linux:7::computenode | All versions | 0:8.24.0-38.el7 |
rsyslog-crypto Red Hat:enterprise_linux:7::computenode | All versions | 0:8.24.0-38.el7 |
rsyslog-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:8.24.0-38.el7 |
rsyslog-doc Red Hat:enterprise_linux:7::computenode | All versions | 0:8.24.0-38.el7 |
rsyslog-elasticsearch Red Hat:enterprise_linux:7::computenode | All versions | 0:8.24.0-38.el7 |
rsyslog-gnutls Red Hat:enterprise_linux:7::computenode | All versions | 0:8.24.0-38.el7 |
rsyslog-gssapi Red Hat:enterprise_linux:7::computenode | All versions | 0:8.24.0-38.el7 |
rsyslog-kafka Red Hat:enterprise_linux:7::computenode | All versions | 0:8.24.0-38.el7 |
rsyslog-libdbi Red Hat:enterprise_linux:7::computenode | All versions | 0:8.24.0-38.el7 |
rsyslog-mmaudit Red Hat:enterprise_linux:7::computenode | All versions | 0:8.24.0-38.el7 |
rsyslog-mmjsonparse Red Hat:enterprise_linux:7::computenode | All versions | 0:8.24.0-38.el7 |
rsyslog-mmkubernetes Red Hat:enterprise_linux:7::computenode | All versions | 0:8.24.0-38.el7 |
rsyslog-mmnormalize Red Hat:enterprise_linux:7::computenode | All versions | 0:8.24.0-38.el7 |
rsyslog-mmsnmptrapd Red Hat:enterprise_linux:7::computenode | All versions | 0:8.24.0-38.el7 |
rsyslog-mysql Red Hat:enterprise_linux:7::computenode | All versions | 0:8.24.0-38.el7 |
rsyslog-pgsql Red Hat:enterprise_linux:7::computenode | All versions | 0:8.24.0-38.el7 |
rsyslog-relp Red Hat:enterprise_linux:7::computenode | All versions | 0:8.24.0-38.el7 |
rsyslog-snmp Red Hat:enterprise_linux:7::computenode | All versions | 0:8.24.0-38.el7 |
rsyslog-udpspoof Red Hat:enterprise_linux:7::computenode | All versions | 0:8.24.0-38.el7 |
rsyslog Red Hat:enterprise_linux:7::hypervisor | All versions | 0:8.24.0-41.el7_7 |
rsyslog-debuginfo Red Hat:enterprise_linux:7::hypervisor | All versions | 0:8.24.0-41.el7_7 |
Products include Debian Debian Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux for Ibm Z Systems, Redhat Enterprise Linux for Power Big Endian, Redhat Enterprise Linux for Power Little Endian, Redhat Enterprise Linux for Scientific Computing and 6 more.
How do I fix CVE-2018-16881?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-16881 being exploited?
There is no known exploitation of CVE-2018-16881 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2018-16881, GHSA-hg54-w573-5vvv, MGASA-2019-0110, RHBA-2019:2501, RHSA-2019:2110, SUSE-SU-2019:0209-1 and 1 more.