CVE-2024-47619: tranport: TLS host name wildcard matching too lax
syslog-ng is an enhanced log daemo. Prior to version 4.8.2, tlswildcardmatch() matches on certificates such as foo..bar although that is not allowed. It is also possible to pass partial wildcards such as foo.ac.bar which glib matches but should be avoided / invalidated. This issue could have an impact on TLS connections, such as in man-in-the-middle situations. Version 4.8.2 contains a fix for the issue.
Other sources
tranport: TLS host name wildcard matching too lax
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47619?
CVE-2024-47619 is classified as a moderate severity vulnerability.
How do I fix CVE-2024-47619?
To fix CVE-2024-47619, upgrade syslog-ng to version 4.8.2 or later.
What type of systems are affected by CVE-2024-47619?
CVE-2024-47619 affects all versions of syslog-ng prior to 4.8.2.
What is the nature of the vulnerability in CVE-2024-47619?
CVE-2024-47619 allows incorrect wildcard matching on certificates, leading to potential validation issues.
Is there a workaround for CVE-2024-47619 if I cannot upgrade?
Currently, there are no established workarounds for CVE-2024-47619, and upgrading is recommended.