{"id":"UBUNTU-CVE-2022-38725","details":"An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function. syslog-ng Premium Edition 7.0.30 and syslog-ng Store Box 6.10.0 are also affected.","modified":"2026-05-20T16:06:44.643447871Z","published":"2023-01-23T16:15:00Z","upstream":["CVE-2022-38725"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-38725"},{"type":"REPORT","url":"https://lists.balabit.hu/pipermail/syslog-ng/"},{"type":"REPORT","url":"https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-7932-4fc6-pvmc"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2022-38725"}],"affected":[{"package":{"name":"syslog-ng","ecosystem":"Ubuntu:14.04:LTS","purl":"pkg:deb/ubuntu/syslog-ng?arch=source&distro=trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.9-1ubuntu1","3.5.1-1","3.5.2-1","3.5.3-1"],"ecosystem_specific":{"binaries":[{"binary_name":"syslog-ng","binary_version":"3.5.3-1"},{"binary_name":"syslog-ng-core","binary_version":"3.5.3-1"},{"binary_name":"syslog-ng-mod-amqp","binary_version":"3.5.3-1"},{"binary_name":"syslog-ng-mod-geoip","binary_version":"3.5.3-1"},{"binary_name":"syslog-ng-mod-json","binary_version":"3.5.3-1"},{"binary_version":"3.5.3-1","binary_name":"syslog-ng-mod-mongodb"},{"binary_version":"3.5.3-1","binary_name":"syslog-ng-mod-redis"},{"binary_name":"syslog-ng-mod-smtp","binary_version":"3.5.3-1"},{"binary_name":"syslog-ng-mod-sql","binary_version":"3.5.3-1"},{"binary_name":"syslog-ng-mod-stomp","binary_version":"3.5.3-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-38725.json"}},{"package":{"name":"syslog-ng","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/syslog-ng?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.6-2build1","3.5.6-2.1"],"ecosystem_specific":{"binaries":[{"binary_name":"syslog-ng","binary_version":"3.5.6-2.1"},{"binary_name":"syslog-ng-core","binary_version":"3.5.6-2.1"},{"binary_version":"3.5.6-2.1","binary_name":"syslog-ng-mod-amqp"},{"binary_name":"syslog-ng-mod-geoip","binary_version":"3.5.6-2.1"},{"binary_name":"syslog-ng-mod-json","binary_version":"3.5.6-2.1"},{"binary_name":"syslog-ng-mod-mongodb","binary_version":"3.5.6-2.1"},{"binary_name":"syslog-ng-mod-redis","binary_version":"3.5.6-2.1"},{"binary_name":"syslog-ng-mod-smtp","binary_version":"3.5.6-2.1"},{"binary_name":"syslog-ng-mod-sql","binary_version":"3.5.6-2.1"},{"binary_name":"syslog-ng-mod-stomp","binary_version":"3.5.6-2.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-38725.json"}},{"package":{"name":"syslog-ng","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/syslog-ng?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.11.1-1ubuntu1","3.11.1-2ubuntu1","3.13.2-3"],"ecosystem_specific":{"binaries":[{"binary_name":"syslog-ng","binary_version":"3.13.2-3"},{"binary_name":"syslog-ng-core","binary_version":"3.13.2-3"},{"binary_name":"syslog-ng-mod-add-contextual-data","binary_version":"3.13.2-3"},{"binary_version":"3.13.2-3","binary_name":"syslog-ng-mod-amqp"},{"binary_name":"syslog-ng-mod-extra","binary_version":"3.13.2-3"},{"binary_name":"syslog-ng-mod-geoip","binary_version":"3.13.2-3"},{"binary_name":"syslog-ng-mod-getent","binary_version":"3.13.2-3"},{"binary_name":"syslog-ng-mod-graphite","binary_version":"3.13.2-3"},{"binary_name":"syslog-ng-mod-journal","binary_version":"3.13.2-3"},{"binary_name":"syslog-ng-mod-json","binary_version":"3.13.2-3"},{"binary_version":"3.13.2-3","binary_name":"syslog-ng-mod-map-value-pairs"},{"binary_version":"3.13.2-3","binary_name":"syslog-ng-mod-mongodb"},{"binary_name":"syslog-ng-mod-python","binary_version":"3.13.2-3"},{"binary_name":"syslog-ng-mod-redis","binary_version":"3.13.2-3"},{"binary_name":"syslog-ng-mod-riemann","binary_version":"3.13.2-3"},{"binary_name":"syslog-ng-mod-smtp","binary_version":"3.13.2-3"},{"binary_version":"3.13.2-3","binary_name":"syslog-ng-mod-snmptrapd-parser"},{"binary_name":"syslog-ng-mod-sql","binary_version":"3.13.2-3"},{"binary_name":"syslog-ng-mod-stardate","binary_version":"3.13.2-3"},{"binary_version":"3.13.2-3","binary_name":"syslog-ng-mod-stomp"},{"binary_name":"syslog-ng-mod-tag-parser","binary_version":"3.13.2-3"},{"binary_name":"syslog-ng-mod-xml-parser","binary_version":"3.13.2-3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-38725.json"}},{"package":{"name":"syslog-ng","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/syslog-ng?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.19.1-6build1","3.19.1-6build2","3.25.1-1","3.25.1-1ubuntu1","3.25.1-3"],"ecosystem_specific":{"binaries":[{"binary_version":"3.25.1-3","binary_name":"syslog-ng"},{"binary_name":"syslog-ng-core","binary_version":"3.25.1-3"},{"binary_name":"syslog-ng-mod-add-contextual-data","binary_version":"3.25.1-3"},{"binary_name":"syslog-ng-mod-amqp","binary_version":"3.25.1-3"},{"binary_name":"syslog-ng-mod-examples","binary_version":"3.25.1-3"},{"binary_name":"syslog-ng-mod-extra","binary_version":"3.25.1-3"},{"binary_version":"3.25.1-3","binary_name":"syslog-ng-mod-geoip2"},{"binary_version":"3.25.1-3","binary_name":"syslog-ng-mod-getent"},{"binary_name":"syslog-ng-mod-graphite","binary_version":"3.25.1-3"},{"binary_name":"syslog-ng-mod-map-value-pairs","binary_version":"3.25.1-3"},{"binary_name":"syslog-ng-mod-mongodb","binary_version":"3.25.1-3"},{"binary_version":"3.25.1-3","binary_name":"syslog-ng-mod-pacctformat"},{"binary_name":"syslog-ng-mod-python","binary_version":"3.25.1-3"},{"binary_name":"syslog-ng-mod-redis","binary_version":"3.25.1-3"},{"binary_name":"syslog-ng-mod-riemann","binary_version":"3.25.1-3"},{"binary_name":"syslog-ng-mod-smtp","binary_version":"3.25.1-3"},{"binary_version":"3.25.1-3","binary_name":"syslog-ng-mod-snmptrapd-parser"},{"binary_version":"3.25.1-3","binary_name":"syslog-ng-mod-sql"},{"binary_name":"syslog-ng-mod-stardate","binary_version":"3.25.1-3"},{"binary_name":"syslog-ng-mod-stomp","binary_version":"3.25.1-3"},{"binary_name":"syslog-ng-mod-tag-parser","binary_version":"3.25.1-3"},{"binary_version":"3.25.1-3","binary_name":"syslog-ng-mod-xml-parser"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-38725.json"}},{"package":{"name":"syslog-ng","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/syslog-ng?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.28.1-2build3","3.28.1-4","3.35.1-1"],"ecosystem_specific":{"binaries":[{"binary_name":"syslog-ng","binary_version":"3.35.1-1"},{"binary_version":"3.35.1-1","binary_name":"syslog-ng-core"},{"binary_name":"syslog-ng-mod-add-contextual-data","binary_version":"3.35.1-1"},{"binary_version":"3.35.1-1","binary_name":"syslog-ng-mod-amqp"},{"binary_version":"3.35.1-1","binary_name":"syslog-ng-mod-examples"},{"binary_version":"3.35.1-1","binary_name":"syslog-ng-mod-extra"},{"binary_name":"syslog-ng-mod-geoip2","binary_version":"3.35.1-1"},{"binary_version":"3.35.1-1","binary_name":"syslog-ng-mod-getent"},{"binary_name":"syslog-ng-mod-graphite","binary_version":"3.35.1-1"},{"binary_name":"syslog-ng-mod-http","binary_version":"3.35.1-1"},{"binary_name":"syslog-ng-mod-map-value-pairs","binary_version":"3.35.1-1"},{"binary_version":"3.35.1-1","binary_name":"syslog-ng-mod-mongodb"},{"binary_version":"3.35.1-1","binary_name":"syslog-ng-mod-python"},{"binary_name":"syslog-ng-mod-rdkafka","binary_version":"3.35.1-1"},{"binary_name":"syslog-ng-mod-redis","binary_version":"3.35.1-1"},{"binary_version":"3.35.1-1","binary_name":"syslog-ng-mod-riemann"},{"binary_version":"3.35.1-1","binary_name":"syslog-ng-mod-slog"},{"binary_name":"syslog-ng-mod-smtp","binary_version":"3.35.1-1"},{"binary_name":"syslog-ng-mod-snmp","binary_version":"3.35.1-1"},{"binary_name":"syslog-ng-mod-sql","binary_version":"3.35.1-1"},{"binary_name":"syslog-ng-mod-stardate","binary_version":"3.35.1-1"},{"binary_version":"3.35.1-1","binary_name":"syslog-ng-mod-stomp"},{"binary_name":"syslog-ng-mod-xml-parser","binary_version":"3.35.1-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-38725.json"}},{"package":{"name":"syslog-ng","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/syslog-ng?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.38.1-5","4.3.1-2","4.3.1-2build1","4.3.1-2build4","4.3.1-2build5"],"ecosystem_specific":{"binaries":[{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng"},{"binary_name":"syslog-ng-core","binary_version":"4.3.1-2build5"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-mod-add-contextual-data"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-mod-amqp"},{"binary_name":"syslog-ng-mod-examples","binary_version":"4.3.1-2build5"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-mod-extra"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-mod-geoip2"},{"binary_name":"syslog-ng-mod-graphite","binary_version":"4.3.1-2build5"},{"binary_name":"syslog-ng-mod-http","binary_version":"4.3.1-2build5"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-mod-mongodb"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-mod-python"},{"binary_name":"syslog-ng-mod-rdkafka","binary_version":"4.3.1-2build5"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-mod-redis"},{"binary_name":"syslog-ng-mod-riemann","binary_version":"4.3.1-2build5"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-mod-slog"},{"binary_name":"syslog-ng-mod-smtp","binary_version":"4.3.1-2build5"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-mod-snmp"},{"binary_name":"syslog-ng-mod-sql","binary_version":"4.3.1-2build5"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-mod-stardate"},{"binary_name":"syslog-ng-mod-stomp","binary_version":"4.3.1-2build5"},{"binary_name":"syslog-ng-mod-xml-parser","binary_version":"4.3.1-2build5"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-scl"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-38725.json"}},{"package":{"name":"syslog-ng","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/syslog-ng?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-4","4.8.1-5","4.8.1-6"],"ecosystem_specific":{"binaries":[{"binary_version":"4.8.1-6","binary_name":"syslog-ng"},{"binary_name":"syslog-ng-core","binary_version":"4.8.1-6"},{"binary_name":"syslog-ng-mod-add-contextual-data","binary_version":"4.8.1-6"},{"binary_name":"syslog-ng-mod-amqp","binary_version":"4.8.1-6"},{"binary_version":"4.8.1-6","binary_name":"syslog-ng-mod-examples"},{"binary_name":"syslog-ng-mod-extra","binary_version":"4.8.1-6"},{"binary_version":"4.8.1-6","binary_name":"syslog-ng-mod-geoip2"},{"binary_version":"4.8.1-6","binary_name":"syslog-ng-mod-graphite"},{"binary_version":"4.8.1-6","binary_name":"syslog-ng-mod-http"},{"binary_name":"syslog-ng-mod-mongodb","binary_version":"4.8.1-6"},{"binary_name":"syslog-ng-mod-python","binary_version":"4.8.1-6"},{"binary_name":"syslog-ng-mod-rdkafka","binary_version":"4.8.1-6"},{"binary_name":"syslog-ng-mod-redis","binary_version":"4.8.1-6"},{"binary_name":"syslog-ng-mod-riemann","binary_version":"4.8.1-6"},{"binary_version":"4.8.1-6","binary_name":"syslog-ng-mod-slog"},{"binary_name":"syslog-ng-mod-snmp","binary_version":"4.8.1-6"},{"binary_name":"syslog-ng-mod-sql","binary_version":"4.8.1-6"},{"binary_version":"4.8.1-6","binary_name":"syslog-ng-mod-stardate"},{"binary_version":"4.8.1-6","binary_name":"syslog-ng-mod-stomp"},{"binary_name":"syslog-ng-mod-xml-parser","binary_version":"4.8.1-6"},{"binary_name":"syslog-ng-scl","binary_version":"4.8.1-6"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-38725.json"}},{"package":{"name":"syslog-ng","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/syslog-ng?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-6","4.8.1-7build1","4.8.1-7build2"],"ecosystem_specific":{"binaries":[{"binary_name":"syslog-ng","binary_version":"4.8.1-7build2"},{"binary_name":"syslog-ng-core","binary_version":"4.8.1-7build2"},{"binary_name":"syslog-ng-mod-add-contextual-data","binary_version":"4.8.1-7build2"},{"binary_name":"syslog-ng-mod-amqp","binary_version":"4.8.1-7build2"},{"binary_version":"4.8.1-7build2","binary_name":"syslog-ng-mod-examples"},{"binary_version":"4.8.1-7build2","binary_name":"syslog-ng-mod-extra"},{"binary_name":"syslog-ng-mod-geoip2","binary_version":"4.8.1-7build2"},{"binary_version":"4.8.1-7build2","binary_name":"syslog-ng-mod-graphite"},{"binary_name":"syslog-ng-mod-http","binary_version":"4.8.1-7build2"},{"binary_name":"syslog-ng-mod-mongodb","binary_version":"4.8.1-7build2"},{"binary_name":"syslog-ng-mod-python","binary_version":"4.8.1-7build2"},{"binary_version":"4.8.1-7build2","binary_name":"syslog-ng-mod-rdkafka"},{"binary_name":"syslog-ng-mod-redis","binary_version":"4.8.1-7build2"},{"binary_version":"4.8.1-7build2","binary_name":"syslog-ng-mod-riemann"},{"binary_name":"syslog-ng-mod-slog","binary_version":"4.8.1-7build2"},{"binary_version":"4.8.1-7build2","binary_name":"syslog-ng-mod-snmp"},{"binary_name":"syslog-ng-mod-sql","binary_version":"4.8.1-7build2"},{"binary_version":"4.8.1-7build2","binary_name":"syslog-ng-mod-stardate"},{"binary_name":"syslog-ng-mod-stomp","binary_version":"4.8.1-7build2"},{"binary_name":"syslog-ng-mod-xml-parser","binary_version":"4.8.1-7build2"},{"binary_version":"4.8.1-7build2","binary_name":"syslog-ng-scl"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-38725.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}