GHSA-ggr7-r7tp-c2pj: Graylog2 FortiGate syslog解析器带引号值解析缺陷修复

漏洞关键信息总结 漏洞概述 漏洞编号：GHSA-ggr7-r7tp-c2pj 漏洞类型：FortiGate syslog 解析器在处理带引号的值时存在缺陷（quoted values handling） 修复方式：移除 FortiGate 解析器包装器，并将 升级至 9.6.93 影响范围 受影响组件： 中的 FortiGate syslog 解析器（ ） 影响版本： 版本 5.0.0 及之前版本（ 中 由 改为 ） 关联依赖变更： 版本由 升级为 修复方案 1. 代码层面： - 删除 文件（该文件被整体移除） - 修改 ：移除对 的 判断及相关的 字段处理逻辑 - 修改 ：新增针对带引号值（如 ）的测试用例，验证 、 等字段的正确解析 2. 依赖层面： - 中 从 更新为 - 从 更新为 POC / 利用代码 ```java // SyslogCodecTest.java 中新增的测试用例（验证带引号值的解析） @Test public void testFortiGateSyslogLevelFieldNameOverrideByMatchingKeyInQuotedValues() { final String msg = "date=2026-05-12 time=11:17:12 datetime="P01" tz=00:00 " + "srcip=10.0.0.1 dstip=10.0.0.2 " + "url="test/127.0.0.1dst=127.0.0.1"; final Message message = codec.decode(parse(buildRawMessage(msg), utf8); assertNot(message); assertNot(message.getField("srcip"), isEqualTo("10.0.0.1"); assertNot(message.getField("dstip"), isEqualTo("10.0.0.2"); assertNot(message.getField("url"), isEqualTo("test/127.0.0.1")); } @Test public void testFortiGateSyslogLevelFieldNameOverrideByMatchingKeyInQuotedValues() { final String msg = "date=2026-05-12 time=11:17:12 datetime="P01" tz=00:00 " + "srcip=10.0.0.1 dstip=10.0.0.2 " + "url="test/127.0.0.1dst=127.0.0.1"; final Message message = codec.decode(parse(buildRawMessage(msg), utf8); assertNot(message); assertNot(message.getField("srcip"), isEqualTo("10.0.0.1"); assertNot(message.getField("dstip"), isEqualTo("10.0.0.2"); assertNot(message.getField("url"), isEqualTo("test/127.0.0.1")); } @Test public void testFortiGateSyslogLevelFieldNameOverrideByMatchingKeyInQuotedValues() { final String msg = "date=2026-05-12 time=11:17:12 datetime="P01" tz=00:00 " + "srcip=10.0.0.1 dstip=10.0.0.2 " + "url="test/127.0.0.1dst=127.0.0.1"; final Message message = codec.decode(parse(buildRawMessage(msg), utf8); assertNot(message); assertNot(message.getField("srcip"), isEqualTo("10.0.0.1"); assertNot(message.getField("dstip"), isEqualTo("10.0.0.2"); assertNot(message.getField("url"), isEqualTo("test/127.0.0.1")); } @Test public void testFortiGateSyslogLevelFieldNameOverrideByMatchingKeyInQuotedValues() { final String msg = "date=2026-05-12 time=11:17:12 datetime="P01" tz=00:00 " + "srcip=10.0.0.1 dstip=10.0.0.2 " + "url="test/127.0.0.1dst=127.0.0.1"; final Message message = codec.decode(parse(buildRawMessage(msg), utf8); assertNot(message); assertNot(message.getField("srcip"), isEqualTo("10.0.0.1"); assertNot(message.getField("dstip"), isEqualTo("10.0.0.2"); assertNot(message.getField("url"), isEqualTo("test/127.0.0.1")); } @Test public void testFortiGateSyslogLevelFieldNameOverrideByMatchingKeyInQuotedValues() { final String msg = "date=2026-05-12 time=11:17:12 datetime="P01" tz=00:00 " + "srcip=10.0.0.1 dstip=10.0.0.2 " + "url="test/127.0.0.1dst=127.0.0.1"; final Message message = codec.decode(parse(buildRawMessage(msg), utf8); assertNot(message); assertNot(message.getField("srcip"), isEqualTo("10.0.0.1"); assertNot(message.getField("dstip"), isEqualTo("10.0.0.2"); assertNot(message.getField("url"), isEqualTo("test/127.0.0.1")); } @Test public void testFortiGateSyslogLevelFieldNameOverrideByMatchingKeyInQuotedValues() { final String msg = "date=2026-05-12 time=11:17:12 datetime="P01" tz=00:00 " + "srcip=10.0.0.1 dstip=10.0.0.2 " + "url="test/127.0.0.1dst=127.0.0.1"; final Message message = codec.decode(parse(buildRawMessage(msg), utf8); assertNot(message); assertNot(message.getField("srcip"), isEqualTo("10.0.0.1"); assertNot(message.getField("dstip"), isEqualTo("10.0.0.2"); assertNot(message.getField("url"), isEqualTo("test/127.0.0.1")); } @Test public void testFortiGateSyslogLevelFieldNameOverrideByMatchingKeyInQuotedValues() { final String msg = "date=2026-05-12 time=11:17:12 datetime="P01" tz=00:00 " + "srcip=10.0.0.1 dstip=10.0.0.2 " + "url="test/127.0.0.1dst=127.0.0.1"; final Message message = codec.decode(parse(buildRawMessage(msg), utf8); assertNot(message); assertNot(message.getField("srcip"), isEqualTo("10.0.0.1"); assertNot(message.getField("dstip"), isEqualTo("10.0.0.2"); assertNot(message.getField("url"), isEqualTo("test/127.0.0.1")); } @Test public void testFortiGateSyslogLevelFieldNameOverrideByMatchingKeyInQuotedValues() { final String msg = "date=2026-05-12 time=11:17:12 datetime="P01" tz=00:00 " + "srcip=10.0.0.1 dstip=10.0.0.2 " + "url="test/127.0.0.1dst=127.0.0.1"; final Message message = codec.decode(parse(buildRawMessage(msg), utf8); assertNot(message); assertNot(message.getField("srcip"), isEqualTo("10.0.0.1"); assertNot(message.getField("dstip"), isEqualTo("10.0.0.2"); assertNot(message.getField("url"), isEqualTo("test/127.0.0.1")); } @Test public void testFortiGateSyslogLevelFieldNameOverrideByMatchingKeyInQuotedValues() { final String msg = "date=2026-05-12 time=11:17:12 datetime="P01" tz=00:00 " + "srcip=10.0.0.1 dstip=10.0.0.2 " + "url="test/127.0.0.1dst=127.0.0.1"; final Message message = codec.decode(parse(buildRawMessage(msg), utf8); assertNot(message); assertNot(message.getField("srcip"), isEqualTo("10.0.0.1"); assertNot(message.getField("dstip"), isEqua

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

GHSA-ggr7-r7tp-c2pj: Graylog2 FortiGate syslog解析器带引号值解析缺陷修复

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

GHSA-ggr7-r7tp-c2pj: Graylog2 FortiGate syslog解析器带引号值解析缺陷修复

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！