Synopsis

Critical: librelp security update

Type/Severity

Security Advisory: Critical

Topic

An update for librelp is now available for Red Hat Enterprise Linux 6.6 Advanced Update Support and Red Hat Enterprise Linux 6.6 Telco Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Librelp is an easy-to-use library for the Reliable Event Logging Protocol (RELP) protocol. RELP is a general-purpose, extensible logging protocol.

Security Fix(es):

• librelp: Stack-based buffer overflow in relpTcpChkPeerName function in src/tcp.c (CVE-2018-1000140)
  

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Rainer Gerhards (rsyslog) for reporting this issue. Upstream acknowledges Bas van Schaik (lgtm.com / Semmle) and Kevin Backhouse (lgtm.com / Semmle) as the original reporters.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server - AUS 6.6 x86_64
• Red Hat Enterprise Linux Server - TUS 6.6 x86_64

Fixes

• BZ - 1560084 - CVE-2018-1000140 librelp: Stack-based buffer overflow in relpTcpChkPeerName function in src/tcp.c

CVEs

• CVE-2018-1000140

References

• https://access.redhat.com/security/updates/classification/#critical

Red Hat Enterprise Linux Server - AUS 6.6

SRPM
librelp-1.2.7-3.el6_6.1.src.rpm	SHA-256: 3bef4db0571c9b3df403779cf3690423b9ac55f399dfb3c1bc589a58c569d818
x86_64
librelp-1.2.7-3.el6_6.1.i686.rpm	SHA-256: f20a82dc1461c9bcd8dc1a6774aebebdb8e9d1621f4cd342a4d5f98fb3156b42
librelp-1.2.7-3.el6_6.1.x86_64.rpm	SHA-256: c85095fcd08000867eb4ba16c78651026e2fdabdbf861fea0c781abcf4091f2f
librelp-debuginfo-1.2.7-3.el6_6.1.i686.rpm	SHA-256: 4de3aef97665bbbcd95661b033eb249ec1f412555849a099b6e6f34caa9457a7
librelp-debuginfo-1.2.7-3.el6_6.1.x86_64.rpm	SHA-256: 271d0f1c28908db153523148f8cda9790df938241ce8eb0c7598fa1b7634ee61
librelp-debuginfo-1.2.7-3.el6_6.1.x86_64.rpm	SHA-256: 271d0f1c28908db153523148f8cda9790df938241ce8eb0c7598fa1b7634ee61
librelp-devel-1.2.7-3.el6_6.1.i686.rpm	SHA-256: e943e132a3e37e77a8710f1f998e9872db9bc4768ed7e4c0f63b1f403d4409cc
librelp-devel-1.2.7-3.el6_6.1.x86_64.rpm	SHA-256: 6ada8c0463b791bf2810f4ec40bfb282c45c55bd75b3ddff09e0473e626340fe

Red Hat Enterprise Linux Server - TUS 6.6

SRPM
librelp-1.2.7-3.el6_6.1.src.rpm	SHA-256: 3bef4db0571c9b3df403779cf3690423b9ac55f399dfb3c1bc589a58c569d818
x86_64
librelp-1.2.7-3.el6_6.1.i686.rpm	SHA-256: f20a82dc1461c9bcd8dc1a6774aebebdb8e9d1621f4cd342a4d5f98fb3156b42
librelp-1.2.7-3.el6_6.1.x86_64.rpm	SHA-256: c85095fcd08000867eb4ba16c78651026e2fdabdbf861fea0c781abcf4091f2f
librelp-debuginfo-1.2.7-3.el6_6.1.i686.rpm	SHA-256: 4de3aef97665bbbcd95661b033eb249ec1f412555849a099b6e6f34caa9457a7
librelp-debuginfo-1.2.7-3.el6_6.1.x86_64.rpm	SHA-256: 271d0f1c28908db153523148f8cda9790df938241ce8eb0c7598fa1b7634ee61
librelp-debuginfo-1.2.7-3.el6_6.1.x86_64.rpm	SHA-256: 271d0f1c28908db153523148f8cda9790df938241ce8eb0c7598fa1b7634ee61
librelp-devel-1.2.7-3.el6_6.1.i686.rpm	SHA-256: e943e132a3e37e77a8710f1f998e9872db9bc4768ed7e4c0f63b1f403d4409cc
librelp-devel-1.2.7-3.el6_6.1.x86_64.rpm	SHA-256: 6ada8c0463b791bf2810f4ec40bfb282c45c55bd75b3ddff09e0473e626340fe