- syslog-ng-announce - lists.balabit.hu

syslog-ng 3.5.5 has been released
by devel＠balabit.hu 21 Jul '14

21 Jul '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.5.5 SUMMARY : new stable release DATE : Jul 21, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.5.5) has been released. For latest fixes in the 3.5.x feature branch you are recommended to upgrade to this version. CHANGES: 3.5.5 Mon, 21 Jul 2014 17:00:00 +0200 This is the fifth bug-fix release for the 3.5.x series. Starting with this release, the 3.5 branch replaces 3.4 as the current "stable" version. Upgrading from earlier versions - and especially earlier branches - is highly recommended. New features ============ * The facility() filter now supports ranges, allowing one to capture a range of facilities: facility(local0..local6). * The $(format-json) template function now supports SEQNUM. * The upstart script in contrib has been improved to allow the user to override certain settings (such as the configuration file, and the pidfile), and allow extra options to be specified. Bugfixes ======== * Major memory leaks have been fixed in various parts of syslog-ng, including but not limited to network and file destinations and sources, value-pairs (thus affecting mongodb, $(format-json), and others), template handling and rewrite rules. Some of these leaks only happened during reload, some leaked on every message. They have now been plugged. * The value-pairs framework has seen a lot of updates, too: - It now honors time zone settings, so everything that uses value-pairs, will correctly take time zone settings into account. - Using globs in the key() option of value pairs will now also search macros for matches (thus key("D*") will match DATE too). - The syslog-proto (RFC5424) scope now correctly includes SDATA. - A bug that resulted in hierarchical elements being misparsed and made to appear in random places have been fixed. * The body() and subject() options of the SMTP destinations are now mandatory, and a double-free was also fixed in the driver. * Minor fixes were made to the $(env) template function, so that when looking up an empty environment variable, we will no longer trigger a glib warning. A misleading error message was also corrected. * The pdbtool patternize tool will now output version 4 PDB XML. * The configure script will not try to configure the AMQP module if no suitable version of python is installed. This avoids a difficult to diagnose error message during compilation. Developer news ============== * When compiled with internal ivykis, we will now install its headers too, along with our own. This is to make it easier for the Incubator to be compiled against a syslog-ng with embedded ivykis. * Plugin symbols are now loaded differently, in a way that lets plugins load further plugins, and use already loaded symbols. This is required for the various scripting destinations in the Incubator. * Starting with this release, we are installing the testing helpers as a convenience library (available under the syslog-ng-test pkg-config module). This allows third party projects to use our helpers. Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Balazs Scheidler <bazsi(a)balabit.hu> Daniel Gados Fabien Wernli Gergely Nagy <algernon(a)balabit.hu> Laszlo Budai <lbudai(a)balabit.hu> Laszlo Meszaros <lmesz(a)balabit.hu> Nick Alcock <nix(a)esperi.org.uk> Peter Czanik <czanik(a)balabit.hu> Peter Gyongyosi <gyp(a)balabit.hu> Sebastien Badia <seb(a)sebian.fr> Tibor Benke <tibor.benke(a)balabit.com> Viktor Juhasz <viktor.juhasz(a)balabit.com> Viktor Tusa <tusa(a)balabit.hu> Xufeng Zhang <xufeng.zhang(a)windriver.com> Zoltan Pallagi <pzolee(a)balabit.hu> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng Premium Edition 5 LTS (5.0.5a) has been released
by devel＠balabit.hu 25 Jun '14

25 Jun '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 5 LTS (5.0.5a) SUMMARY : new stable release DATE : Jun 24, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (5 LTS (5.0.5a)) has been released. For latest fixes in the 5.0.x branch you are recommended to upgrade to this version. CHANGES: 5 LTS (5.0.5a) Tue, 24 June 2014 15:50:20 +0100 Security updates: CVE-2014-0221, CVE-2014-0224, CVE-2014-0195, CVE-2014-0198, CVE-2014-5298, CVE-2014-3470, CVE-2014-0076 For details on the fixed issues see the following OpenSSL Security Advisory: https://www.openssl.org/news/secadv_20140605.txt DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/sup… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 5 LTS (5.0.5a) Administrator Guide at: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/sup… Kind Regards, BalaBit IT Security You are receiving this email because you showed interest in our products. Unsubscribe <http://www.balabit.com/newsletter/unsubscribe/4398019b4f2681fdce75b07177a63…> from the syslog-ng Premium Edition Technical Newsletter.

1 0

Upcoming syslog-ng PE releases to fix OpenSSL vulnerability
by devel＠balabit.hu 16 Jun '14

16 Jun '14

------------------------------------------------------------------------------ SUMMARY : Upcoming syslog-ng PE releases to fix OpenSSL vulnerability PACKAGE : syslog-ng Premium Edition VERSION : all versions DATE : Jun 12, 2014 ------------------------------------------------------------------------------ DESCRIPTION: OpenSSL has released updates patching 7 vulnerabilities, which may allow an attacker to decrypt or modify traffic between a vulnerable client and server, cause a denial of service condition, or remotely execute arbitrary code. All maintained syslog-ng PE versions (4LTS, 5LTS, 5F1) are affected by the following CVEs: CVE-2014-0221 CVE-2014-0224 (a.k.a the CCS Injection Vulnerability) CVE-2014-0195 CVE-2014-0198 CVE-2014-5298 CVE-2014-3470 CVE-2014-0076 A security update of the affected versions shall be released as follows: * 5.0.5a by the end of 2014Q2 * 4.0.7b in July 2014 * 5.1.1a in July 2014 As an immediate prevention against attacks based on the CCS Injection vulnerability, you should consider configuring two-way authentication for TLS-encrypted connections. Best Regards, BalaBit IT Security You are receiving this email because you showed interest in our products. Unsubscribe <http://www.balabit.com/newsletter/unsubscribe/4398019b4f2681fdce75b07177a63…> from the syslog-ng Premium Edition Technical Newsletter.

1 0

syslog-ng Premium Edition 5 LTS (5.0.5) has been released
by devel＠balabit.hu 11 Jun '14

11 Jun '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 5 LTS (5.0.5) SUMMARY : new stable release DATE : May 28, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (5 LTS (5.0.5)) has been released. For latest fixes in the 5.0.x branch you are recommended to upgrade to this version. CHANGES: 5 LTS (5.0.5) Wed, 28 May 2014 15:31:20 +0100 Fixed bugs: #31447 When reverting to old configuration, log messages are duplicated #31452 syslog-ng client spins if it cannot validate the server certificate ("certificate verify failed") #31463 Reading huge messages from file source causes memory (heap) corruption #31469 Having multiple destinations using the same server and port causes problems #31478 The retry_sql_inserts option does not work when using reliable disk-buffer #31567 TLS-encrypted RLTP connections from multiple clients can crash the server #31609 Using a source in a flow-controlled logpath applies flow-controlled to every logpath that includes the source #31628 Messages generated before, but received after the daylight-saving change can have incorrect day information #31304 Incorrect loglevel for internal messages generated when the audit logs are cleared #31337 Improve the syslog-ng Agent error messages for EventID 167 #31425 Improve the syslog-ng Agent error messages for EventID 163 #31538 TLS-encrypted communication fails in the Windows Agent ("CAPI_RSA_SIGN:unsupported algorithm nid") #31565 syslog-ng Agent leaks memory on Windows Vista or newer platforms For details on the fixed issues see our issue tracking page at https://www.balabit.com/mybalabit/fixed-bugs/revision/syslog-ng-pe/5.0.5 DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/sup… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 5 LTS (5.0.5) Administrator Guide at: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/sup… Kind Regards, BalaBit IT Security You are receiving this email because you showed interest in our products. Unsubscribe <http://www.balabit.com/newsletter/unsubscribe/4398019b4f2681fdce75b07177a63…> from the syslog-ng Premium Edition Technical Newsletter.

1 0

syslog-ng Premium Edition 5 F1 (5.1.1) has been released
by devel＠balabit.hu 10 Jun '14

10 Jun '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 5 F1 (5.1.1) SUMMARY : New syslog-ng Premium Edition feature release DATE : May 28, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new version of syslog-ng Premium Edition 5 F1 (5.1.1) has been released. For latest fixes in the 5 F1 (5.1.x) branch you are recommended to upgrade to this version. CHANGES: 5 F1 (5.1.1) Wed, 28 May 2014 14:08:00 Dear syslog-ng Premium Edition Users, A new feature version of the syslog-ng Premium Edition (PE) has been released. To read about the new features of syslog-ng Premium Edition 5 F1 (5.1.1), see the What's New guide at: http://www.balabit.com/support/documentation/ New feature highlights: * Send logs to MongoDB database servers * Parse JSON-formatted messages * Format messages following the JSON standard * Installers for several new platforms The documentation of syslog-ng 5.1, including the installation and user guides is available in PDF, HTML, and single-page HTML format at: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/sup… UPGRADE: For details on upgrading and possible upgrade paths, read upgrading syslog-ng in the The syslog-ng Premium Edition 5.1 Administrator Guide. Kind Regards, BalaBit IT Security For details on the fixed issues see our new issue tracking page at https://www.balabit.com/mybalabit/fixed-bugs/revision/ DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/sup… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 5 F1 (5.1.1) Administrator Guide at: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/sup… Kind Regards, BalaBit IT Security You are receiving this email because you showed interest in our products. Unsubscribe <http://www.balabit.com/newsletter/unsubscribe/4398019b4f2681fdce75b07177a63…> from the syslog-ng Premium Edition Technical Newsletter.

1 0

syslog-ng 3.4.8 has been released
by devel＠balabit.hu 06 Jun '14

06 Jun '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.4.8 SUMMARY : new stable release DATE : Jun 6, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.4.8) has been released. For latest fixes in the 3.4.x feature branch you are recommended to upgrade to this version. CHANGES: 3.4.8 Fri, 6 Jun 2014 12:05:59 +0200 This is the seventh bug-fix release for the 3.4.x series, with a set of important fixes over 3.4.7 released last December. Upgrading to this release is highly recommended. Features ======== * Support for tzif3 format timezone files (used by recent releases of the tzdata package) was implemented. * SDATA enterprise IDs are now handled correctly when using value-pairs, they will not be needlessly split up into smaller chunks. Bugfixes ======== * Drivers using value-pairs() (mongodb, format-json, etc) were made more robust, and will not behave strangely anymore when using higher compiler optimisation levels. * The DATE macro in most value-pairs() scopes will now always contain the stamp time, as opposed to sometimes the received or the stamp time. * The syslog-proto (rfc5424) scope of value-pairs() now includes SDATA too. * The $SEQNUM macro is now correctly handled by the $(format-json) template function. * Drivers using value-pairs() will now work correctly when a macro is specified in a key() statement. * When using the same json-parser() in multiple log paths, syslog-ng no longer crashes when no marker was set. * When a GeoIP lookup fails, handle it gracefully, avoiding an annoying glib warning. * When running in a FreeBSD jail, the system() source will not use /dev/klog. * Various memory leaks were plugged (related to internal locking, and value-pairs). * When building from Git, the grammar files are now build-able with bison 3+. Builds from tarballs are unaffected. Miscellaneous changes ===================== * The host() and port() options of the MongoDB destination driver have been labelled as deprecated. They already were, just not marked so. * The username() and password() options of the AMQP driver were made mandatory. Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Andras Mitzki <micek(a)balabit.hu> Balazs Scheidler <bazsi(a)balabit.hu> Daniel Gados <gdani(a)balabit.hu> Fabien Wernli Gergely Nagy <algernon(a)balabit.hu> Igor Ippolitov <iippolitov(a)gmail.com> Laszlo Meszaros <lmesz(a)balabit.hu> Nick Alcock <nix(a)esperi.org.uk> Peter Czanik <czanik(a)balabit.hu> Tibor Benke <btibi(a)balabit.hu> Viktor Tusa <tusa(a)balabit.hu> Xufeng Zhang <xufeng.zhang(a)windriver.com> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng Premium Edition 5 LTS (5.0.4a) has been released
by devel＠balabit.hu 11 Apr '14

11 Apr '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 5 LTS (5.0.4a) SUMMARY : new stable release DATE : Apr 11, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (5 LTS (5.0.4a)) has been released. For latest fixes in the 5.0.x branch you are recommended to upgrade to this version. CHANGES: 5 LTS (5.0.4a) Wed, 9 April 2014 15:31:20 +0100 Security updates: CVE-2014-0160: The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug. The syslog-ng Premium Edition 5 LTS was packaged with a vulnerable OpenSSL version. OpenSSL has been patched and updated in this release and syslog-ng PE is no longer vulnerable to this attack. Earlier versions of syslog-ng PE are not affected. For details on the fixed issues see our issue tracking page at https://www.balabit.com/mybalabit/fixed-bugs/revision/ DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/sup… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 5 LTS (5.0.4a) Administrator Guide at: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/sup… Kind Regards, BalaBit IT Security You are receiving this email because you showed interest in our products. Unsubscribe <http://www.balabit.com/newsletter/unsubscribe/4398019b4f2681fdce75b07177a63…> from the syslog-ng Premium Edition Technical Newsletter.

1 0

syslog-ng 3.5.4.1 has been released
by devel＠balabit.hu 13 Mar '14

13 Mar '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.5.4.1 SUMMARY : new stable release DATE : Mar 13, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.5.4.1) has been released. For latest fixes in the 3.5.x feature branch you are recommended to upgrade to this version if you are running on a 32-bit platform. CHANGES: 3.5.4.1 Thu, 13 Mar 2014 10:46:07 +0100 This is the fourth bug-fix release for the 3.5.x series, with a single fix for 32-bit platforms. Upgrading to this version is highly recommended for people using 32-bit platforms, others are not affected. Bugfixes ======== * The basic template functions (substr, +, -, etc) were fixed to work correctly on 32-bit platforms, following up on a previous change that changed how numbers are parsed. Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Gergely Nagy <algernon(a)balabit.hu> Peter Czanik <czanik(a)balabit.hu> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng 3.5.4 has been released
by devel＠balabit.hu 12 Mar '14

12 Mar '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng VERSION : 3.5.4 SUMMARY : new stable release DATE : Mar 12, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Open Source Edition (3.5.4) has been released. For latest fixes in the 3.5.x feature branch you are recommended to upgrade to this version. CHANGES: 3.5.4 Wed, 12 Mar 2014 13:18:36 +0100 This is the third bug-fix release for the 3.5.x series, with a number of important improvements over the previous release. Upgrading to this version is highly recommended. Bugfixes ======== * The value-pairs code had a serious bug, where under some circumstances (depending on compiler, platform and optimisation flags), it could end up in a live-lock, where the only way out was to forcibly kill the syslog-ng process. * SDATA enterprise IDs are handled better when using value-pairs (MongoDB, $(format-json), etc): the enterprise id is kept together, the possibly dotted numeric ID is not split into sub-structures anymore. * json-parser() can now be used from multiple log paths without crashing the syslog-ng process. * Options that can take a unit-suffixed number now work correctly on 32-bit big-endian platforms. * Using some time-related macros (like R_SEC) in filters do not crash syslog-ng anymore. * The internal copy of libmongo-client was updated to version 0.1.7.1, which fixes an important bug in the safe mode handling code. * The system() source learned to recognise FreeBSD jails, and will not use /dev/klog when running inside one. * The host() and port() options of the MongoDB destination have been marked obsolete (which were documented as such, but the code didn't follow). * The username() and password() options are now mandatory for the AMQP destination, and syslog-ng raises an error if either of them is unset. This is because the destination does not work without them anyway. * The timezone file parser now supports Tzif3 formatted files too. * The $(geoip) template function handles failed look-ups gracefully: it expands to an empty string then, and does not print a warning anymore. * The source code was updated to work with bison 3 and later (only affects people compiling from git, or rebuilding grammar files). * The syslog-ng pkg-config file now has an scldir and a datarootdir variable too, to help third-party packages. Credits ======= syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. These people have helped in this release: Andras Mitzki <micek(a)balabit.hu> Andres Tamayo <Andres.Tamayo(a)viasat.com> Balazs Scheidler <bazsi(a)balabit.hu> Daniel Gados <gdani(a)balabit.hu> Evan Rempel <erempel(a)uvic.ca> Fabien Wernli <bugzilla.balabit(a)faxm0dem.org> Gergely Nagy <algernon(a)balabit.hu> Igor Ippolitov <iippolitov(a)gmail.com> Peter Czanik <czanik(a)balabit.hu> Steve Berryman <steve(a)berryman.org.uk> Tibor Benke <btibi(a)balabit.hu> Viktor Tusa <tusa(a)balabit.hu> DOWNLOAD: You can download the source or binary packages from: http://www.balabit.com/network-security/syslog-ng/opensource-logging-system… The documentation of the syslog-ng Open Source Edition is available in The syslog-ng Open Source Edition Administrator's Guide at http://www.balabit.com/support/documentation/

1 0

syslog-ng Premium Edition 4 LTS (4.0.7) has been released
by devel＠balabit.hu 11 Mar '14

11 Mar '14

------------------------------------------------------------------------------ PACKAGE : syslog-ng Premium Edition VERSION : 4 LTS (4.0.7) SUMMARY : new stable release DATE : Mar 11, 2014 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of syslog-ng Premium Edition (4 LTS (4.0.7)) has been released. For a full description on stable and feature releases, see Section 2.16. Stable and feature releases of syslog-ng PE in The syslog-ng Premium Edition 4 LTS (4.0.7) Administrator Guide. CHANGES: 4 LTS (4.0.7) Tue, 11 March 2014 15:09:35 +0100 Fixed bugs: #27595 syslog-ng might crash when changing the name of a source with a reload while the source is in use #30777 lgstool cat with template does not display SDATA fields correctly #31173 relative symlinks in wildcard sources caused syslog-ng to crash #31181 read from wildcard file source not working properly on AIX #31395 certain mark-mode() settings can prevent syslog-ng stats to be logged #31396 syslog-ng crashes while trying to process an invalid logstore journal file For details on the fixed issues see our issue tracking page at http://www.balabit.com/mybalabit/fixed-bugs/revision/ DOWNLOAD: Download the latest binaries from: http://www.balabit.com/network-security/syslog-ng/central-syslog-server/upg… Note that to download the binaries, you have to login into your MyBalaBit account. The documentation of the syslog-ng application is available in The syslog-ng Premium Edition 4 LTS (4.0.7) Administrator Guide at: http://www.balabit.com/support/documentation/ Kind Regards, BalaBit IT Security You are receiving this email because you showed interest in our products. Unsubscribe <http://www.balabit.com/newsletter/unsubscribe/4398019b4f2681fdce75b07177a63…> from the syslog-ng Premium Edition Technical Newsletter.

1 0