CVE-2024-47619: tranport: TLS host name wildcard matching too lax
syslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo.*.bar` although that is not allowed. It is also possible to pass partial wildcards such as `foo.a*c.bar` which glib matches but should be avoided / invalidated. This issue could have an impact on TLS connections, such as in man-in-the-middle situations. Version 4.8.2 contains a fix for the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47619?
CVE-2024-47619 is classified as a moderate severity vulnerability.
How do I fix CVE-2024-47619?
To fix CVE-2024-47619, upgrade syslog-ng to version 4.8.2 or later.
What type of systems are affected by CVE-2024-47619?
CVE-2024-47619 affects all versions of syslog-ng prior to 4.8.2.
What is the nature of the vulnerability in CVE-2024-47619?
CVE-2024-47619 allows incorrect wildcard matching on certificates, leading to potential validation issues.
Is there a workaround for CVE-2024-47619 if I cannot upgrade?
Currently, there are no established workarounds for CVE-2024-47619, and upgrading is recommended.