What’s Vulnerable › Vulnerabilities

CVE-2022-38725

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-01-23 · updated 2026-06-17
• Weakness: CWE-190

Description

An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function. syslog-ng Premium Edition 7.0.30 and syslog-ng Store Box 6.10.0 are also affected.

Affected products

• OneIdentity Syslog-Ng: before 3.38.1; before 7.0.32 — fixed in 3.38.1, 7.0.32
• OneIdentity Syslog-Ng Store Box: before 6.0.5; before 7.0 — fixed in 6.0.5, 7.0

How to fix

Upgrade to a fixed version: OneIdentity Syslog-Ng 3.38.1, 7.0.32; OneIdentity Syslog-Ng Store Box 6.0.5, 7.0. Check the vendor advisory for mitigations.

References

• https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-7932-4fc6-pvmc
• https://lists.balabit.hu/pipermail/syslog-ng/
• https://lists.debian.org/debian-lts-announce/2023/02/msg00043.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3TZ7U2GQTAHVHJXSSEHQS5D2Q5T6SZB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QU36HCM3VZYANUYFC6XFYEYJEKQPA2Q7/
• https://security.gentoo.org/glsa/202305-09
• https://www.debian.org/security/2023/dsa-5369
• https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-7932-4fc6-pvmc
• https://lists.balabit.hu/pipermail/syslog-ng/
• https://lists.debian.org/debian-lts-announce/2023/02/msg00043.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3TZ7U2GQTAHVHJXSSEHQS5D2Q5T6SZB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QU36HCM3VZYANUYFC6XFYEYJEKQPA2Q7/

Get alerted when CVE-2022-38725 or the next vulnerability affects your stack