[RHSA-2018:1701-01] Critical: librelp security update

[Security announcements for all Red Hat products and services.]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: librelp security update
Advisory ID:       RHSA-2018:1701-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:1701
Issue date:        2018-05-23
CVE Names:         CVE-2018-1000140 
=====================================================================

1. Summary:

An update for librelp is now available for Red Hat Enterprise Linux 6.6
Advanced Update Support and Red Hat Enterprise Linux 6.6 Telco Extended
Update Support.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Server AUS (v. 6.6) - x86_64
Red Hat Enterprise Linux Server Optional AUS (v. 6.6) - x86_64
Red Hat Enterprise Linux Server Optional TUS (v. 6.6) - x86_64
Red Hat Enterprise Linux Server TUS (v. 6.6) - x86_64

3. Description:

Librelp is an easy-to-use library for the Reliable Event Logging Protocol
(RELP) protocol. RELP is a general-purpose, extensible logging protocol.

Security Fix(es):

* librelp: Stack-based buffer overflow in relpTcpChkPeerName function in
src/tcp.c (CVE-2018-1000140)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

Red Hat would like to thank Rainer Gerhards (rsyslog) for reporting this
issue. Upstream acknowledges Bas van Schaik (lgtm.com / Semmle) and Kevin
Backhouse (lgtm.com / Semmle) as the original reporters.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1560084 - CVE-2018-1000140 librelp: Stack-based buffer overflow in relpTcpChkPeerName function in src/tcp.c

6. Package List:

Red Hat Enterprise Linux Server AUS (v. 6.6):

Source:
librelp-1.2.7-3.el6_6.1.src.rpm

x86_64:
librelp-1.2.7-3.el6_6.1.x86_64.rpm
librelp-debuginfo-1.2.7-3.el6_6.1.x86_64.rpm

Red Hat Enterprise Linux Server TUS (v. 6.6):

Source:
librelp-1.2.7-3.el6_6.1.src.rpm

x86_64:
librelp-1.2.7-3.el6_6.1.x86_64.rpm
librelp-debuginfo-1.2.7-3.el6_6.1.x86_64.rpm

Red Hat Enterprise Linux Server Optional AUS (v. 6.6):

x86_64:
librelp-1.2.7-3.el6_6.1.i686.rpm
librelp-debuginfo-1.2.7-3.el6_6.1.i686.rpm
librelp-debuginfo-1.2.7-3.el6_6.1.x86_64.rpm
librelp-devel-1.2.7-3.el6_6.1.i686.rpm
librelp-devel-1.2.7-3.el6_6.1.x86_64.rpm

Red Hat Enterprise Linux Server Optional TUS (v. 6.6):

x86_64:
librelp-1.2.7-3.el6_6.1.i686.rpm
librelp-debuginfo-1.2.7-3.el6_6.1.i686.rpm
librelp-debuginfo-1.2.7-3.el6_6.1.x86_64.rpm
librelp-devel-1.2.7-3.el6_6.1.i686.rpm
librelp-devel-1.2.7-3.el6_6.1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-1000140
https://access.redhat.com/security/updates/classification/#critical

8. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBWwWNmdzjgjWX9erEAQgS2RAAgt7TBrR9G4bJzs9KKj6EenAcvvHO48OH
FCOAf0VLb8rhsC2VO7TAogALqxHiNZywPapvuWohwZwB13kQi8F1BRb9fDlie1j9
uqfwRwX2ZwfxDeshghSNByjUFRfr4pTg2q/6tcg79i3a97hyBh286bjy3fKUzkJN
JTCulh5uRkA+Hz5VBXqBtZFkUfe4zXkasPskLAuOrEAapNsGLU1ahHL2PQZHJh5Z
R82P1xfUhM9p1R6uWP+SkGDako65p7L4wCMRDuJoDfi/DwrUv3StWfrFLyEpcOLa
7IIUK3oLeRDOw5HPTj1sw1uLKR3Ghg11+QaU5ouJXqwE1fpGBpTeRNka7IBE1w/A
KHPnCZsENRR6YoBWDWS3vvD5d2C8oK0SQdbVycsjrJNjVvZcBQx9Dgm+eZl8by8Q
U5ugxqNjW0g3qV4bIJHKfaftnzPgON4fFOJy8uYQtB51ndr1LsXKHA8mQQYF1dUO
r5MTlTgXZwTjHMi61elenYVZfGnYuXHKqEs7M+3cI62oo3/tAkg6Xc8oLXA+DWxj
ThXJAHBuo0Ug4wgcqkhcoR0mr4++0RzSZEzbX4J4oGz/6CZ6HVDqmgFmD+CczgPp
rv2YjNAMJfM3K+TRj2A9atFOXC9yJ4Oniprx+kLJ9uGUGV09GYMzoIUjaHi+UCtz
y1TdE82dZAA=
=1JWL
-----END PGP SIGNATURE-----