Improper Certificate Matching in syslog-ng by Ovidiu Lupan

CVE-2024-47619

What is CVE-2024-47619?

The syslog-ng log daemon, prior to version 4.8.2, contains a vulnerability in its handling of wildcard matches in TLS certificate verification. Specifically, the function tls_wildcard_match() incorrectly allows matches on certificate patterns such as foo.*.bar and partial wildcards like foo.a*c.bar. These improper matches pose risks to secure TLS communications, potentially enabling man-in-the-middle attacks where an attacker could exploit this to intercept or manipulate data. Version 4.8.2 addresses this issue by enforcing stricter validation for TLS certificate matching.

References