Security Fix

CVE-2011-3200

A two byte buffer overflow flaw was found in the rsyslog daemon's parseLegacySyslogMsg function. An attacker able to submit log messages to rsyslogd could use this flaw to crash the daemon.

BZ#661858

Previously, running rsyslog with Transport Layer Security (TLS) and TCP caused extensive memory and CPU consumption. Consequent to this, the system could become unresponsive. The source code has been modified and problems with the memory and CPU consumption no longer occur.

BZ#698705

Prior to this update, the rsyslog initscript created an invalid lock file named rsyslogd. As a consequence, rsyslog and rsyslogd did not match and the rc daemon did not stop the process when shutting down the system. With this update, the source code is modified so that the initscript creates a valid lock file.

BZ#701782

On the IBM System z and PowerPC architectures, the rsyslog daemon did not respect the configuration to send messages using TLS encryption. As a consequence, messages were sent as plain text. With this update, rsyslog is modified to send messages encrypted.

BZ#727208

Previously, the "ActionExecOnlyOnceEveryInterval" directive did not work as expected. If another message came within the time limit, the timeout got reset and would never expire. This problem has been fixed and the timeout now expires as expected.

BZ#618488

Previously, rsyslog did not build the omsnmp module by default. This update provides the omsnmp module so that users are able to send syslog messages over Simple Network Management Protocol (SNMP).

BZ#683537

Previously, the rsyslog daemon included /var/log/boot.log in the /etc/logrotate.d/syslog file. The rotation caused a new boot.log file to be created with zero length, while a date was appended to the old one. Eventually, after a certain number of rotations, the boot.log data got lost. With this update, rotation is no longer used for /var/log/boot.log.

BZ#702314

This update includes the new ommail module in the rsyslog package, which can be used for sending emails based on received syslog events.

BZ#737096

This update introduces the new "SpaceLFOnReceive" configuration option and the "RSYSLOG_SysklogdFileFormat" format template. These new features allow users to configure rsyslog to behave like the sysklogd daemon, which was available in previous releases.

BZ#742275

This update introduces the new configuration option "SpaceLFOnReceive" and the log format template "RSYSLOG_SysklogdFileFormat". These new features allow users to configure rsyslog to behave like the old sysklogd daemon, available in previous releases.

713139

Prior to this update, the "$ActionSendStreamDriverMode" configuration directive did not have any effect on big-endian platforms. Due to this behavior, the Transport Layer Security (TLS) encryption was not enabled. This update modifies the code to correctly process the configuration directive. Now, TLS encryption works as expected.