CVE-2026-39879
Description
A flaw was found in syslog-ng. An attacker on an adjacent network can exploit a missing sanitization call in the afsql_dd_run_query function, leading to a SQL injection vulnerability. This vulnerability, when the SQL driver is manually configured, can result in a denial of service and allow for limited data manipulation from an untrusted source.
Statement
This is an Important flaw in syslog-ng, as an attacker on an adjacent network could perform SQL injection. This vulnerability is not present in default configurations and requires the SQL driver to be manually configured, limiting its immediate impact on typical Red Hat deployments. Successful exploitation could lead to denial of service and limited data manipulation.
Mitigation
To mitigate this vulnerability, avoid manually configuring and enabling the syslog-ng SQL driver if it is not essential for your environment. If the SQL driver is required, restrict network access to the syslog-ng instance to trusted networks only, for example, by configuring firewall rules to limit connections to the syslog-ng port. Note that changes to network configurations or syslog-ng service settings may require a service reload or restart to take effect, which could temporarily interrupt logging services.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Execute Unauthorized Code or Commands; Hide Activities; Unexpected State
ANSI escape codes can be used for low-severity attacks such as changing the color of console output, but they can also be used to arbitrarily move the cursor, clear the screen, and make fake prompts inside the interactive CLI via malicious user input. In some contexts - depending on the functionality of the terminal in use - ANSI escape codes can be used to execute arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
