CVE-2008-5617

Published: Dec 17, 2008Modified: Apr 23, 2026

8.5

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:C

Exploitability: 10.0 / Impact: 7.8

Source: NVD

Description

The ACL handling in rsyslog 3.12.1 to 3.20.0, 4.1.0, and 4.1.1 does not follow $AllowedSender directive, which allows remote attackers to bypass intended access restrictions and spoof log messages or create a large number of spurious messages.

Affected (28)

Products: Rsyslog: Rsyslog

Rsyslog

1 product

Rsyslog

Configuration A

28 vulnerable

Vulnerable Software	Affected Versions
Rsyslog Rsyslog	Version 3.12.1
Rsyslog Rsyslog	Version 3.12.2
Rsyslog Rsyslog	Version 3.12.3
Rsyslog Rsyslog	Version 3.12.4
Rsyslog Rsyslog	Version 3.12.5
Rsyslog Rsyslog	Version 3.13.0
Rsyslog Rsyslog	Version 3.15.0
Rsyslog Rsyslog	Version 3.15.1 beta
Rsyslog Rsyslog	Version 3.17.0
Rsyslog Rsyslog	Version 3.17.1
Rsyslog Rsyslog	Version 3.17.4 beta
Rsyslog Rsyslog	Version 3.17.5 beta
Rsyslog Rsyslog	Version 3.19.0
Rsyslog Rsyslog	Version 3.19.10
Rsyslog Rsyslog	Version 3.19.11
Rsyslog Rsyslog	Version 3.19.12
Rsyslog Rsyslog	Version 3.19.1
Rsyslog Rsyslog	Version 3.19.2
Rsyslog Rsyslog	Version 3.19.3
Rsyslog Rsyslog	Version 3.19.4
Rsyslog Rsyslog	Version 3.19.5
Rsyslog Rsyslog	Version 3.19.6
Rsyslog Rsyslog	Version 3.19.7
Rsyslog Rsyslog	Version 3.19.8
Rsyslog Rsyslog	Version 3.19.9
Rsyslog Rsyslog	Version 3.20.0
Rsyslog Rsyslog	Version 4.1.0
Rsyslog Rsyslog	Version 4.1.1