--- title: "CVE-2019-17042\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2019-17042?format=md keywords: index, follow --- # CVE-2019-17042 Publication date 7 October 2019 Last updated 26 August 2025 --- Ubuntu priority **Low** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) ## Cvss 3 Severity Score **9.8 · Critical** [Score breakdown](https://ubuntu.com/security/CVE-2019-17042?format=md#impact-score) Toggle side navigation ## Description An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon), but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow. [Read the notes from the security team](https://ubuntu.com/security/CVE-2019-17042?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | rsyslog | 26.04 LTS resolute | Not affected | | 25.10 questing | Not affected | | 25.04 plucky | Not affected | | 24.10 oracular | Not affected | | 24.04 LTS noble | Not affected | | 23.10 mantic | Not affected | | 23.04 lunar | Not affected | | 22.10 kinetic | Not affected | | 22.04 LTS jammy | Not affected | | 21.10 impish | Not affected | | 21.04 hirsute | Not affected | | 20.10 groovy | Not affected | | 20.04 LTS focal | Not affected | | 19.10 eoan | Ignored end of life | | 19.04 disco | Ignored end of life | | 18.04 LTS bionic | Vulnerable | | 16.04 LTS xenial | Fixed 8.16.0-1ubuntu3.1+esm1 Ubuntu Pro | | 14.04 LTS trusty | Needs evaluation | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ### Get expanded security coverage with Ubuntu Pro Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use. [Get Ubuntu Pro](https://ubuntu.com/pro) [30-day free trial](https://ubuntu.com/pro/free-trial) ## Notes --- ### [mdeslaur](https://launchpad.net/~mdeslaur) requires pmcisconames module to be loaded, which is not enabled in the default configuration ## Severity score breakdown CVSS version: CVSS v3.0 **Base score** 9.8 · Critical * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Network | | Attack complexity | Low | | Privileges required | None | | User interaction | None | | Scope | Unchanged | | Confidentiality impact | High | | Integrity impact | High | | Availability impact | High | * Scores | Parameter | Value | | --- | --- | | Base score | 9.8 · Critical | | Exploitability score | - | | Impact score | - | **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17042) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-17042) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2019-17042) * [Debian](https://security-tracker.debian.org/tracker/CVE-2019-17042) ### Related Ubuntu Security Notices (USN) + [USN-5419-1](https://usn.ubuntu.com/USN-5419-1) + Rsyslog vulnerabilities + 12 May 2022 ### Other references * *