GHSA-ggr7-r7tp-c2pj: Graylog2 FortiGate syslog quoted value parsing fix

Key Vulnerability Information Summary Vulnerability Overview Vulnerability ID: GHSA-ggr7-r7tp-c2pj Vulnerability Type: Defect in the FortiGate syslog parser when handling quoted values Remediation: Remove the FortiGate parser wrapper and upgrade to version 9.6.93 Scope of Impact Affected Component: FortiGate syslog parser ( ) within Affected Versions: version 5.0.0 and earlier (the in was changed from to ) Related Dependency Change: The version was upgraded from to Remediation Plan 1. Code Level: - Deleted the file (the file was removed entirely) - Modified : Removed the check for and the associated field handling logic - Modified : Added test cases for quoted values (e.g., ) to verify the correct parsing of fields such as and 2. Dependency Level: - Updated in from to - Updated from to POC / Exploit Code ```java // New test case added in SyslogCodecTest.java (verifying parsing of quoted values) @Test public void testFortiGateSyslogLevelFieldNameOverrideByMatchingKeyInQuotedValues() { final String msg = "date=2026-05-12 time=11:17:12 datetime="P01" tz=00:00 " + "srcip=10.0.0.1 dstip=10.0.0.2 " + "url="test/127.0.0.1dst=127.0.0.1"; final Message message = codec.decode(parse(buildRawMessage(msg), utf8); assertNot(message); assertNot(message.getField("srcip"), isEqualTo("10.0.0.1"); assertNot(message.getField("dstip"), isEqualTo("10.0.0.2"); assertNot(message.getField("url"), isEqualTo("test/127.0.0.1")); } @Test public void testFortiGateSyslogLevelFieldNameOverrideByMatchingKeyInQuotedValues() { final String msg = "date=2026-05-12 time=11:17:12 datetime="P01" tz=00:00 " + "srcip=10.0.0.1 dstip=10.0.0.2 " + "url="test/127.0.0.1dst=127.0.0.1"; final Message message = codec.decode(parse(buildRawMessage(msg), utf8); assertNot(message); assertNot(message.getField("srcip"), isEqualTo("10.0.0.1"); assertNot(message.getField("dstip"), isEqualTo("10.0.0.2"); assertNot(message.getField("url"), isEqualTo("test/127.0.0.1")); } @Test public void testFortiGateSyslogLevelFieldNameOverrideByMatchingKeyInQuotedValues() { final String msg = "date=2026-05-12 time=11:17:12 datetime="P01" tz=00:00 " + "srcip=10.0.0.1 dstip=10.0.0.2 " + "url="test/127.0.0.1dst=127.0.0.1"; final Message message = codec.decode(parse(buildRawMessage(msg), utf8); assertNot(message); assertNot(message.getField("srcip"), isEqualTo("10.0.0.1"); assertNot(message.getField("dstip"), isEqualTo("10.0.0.2"); assertNot(message.getField("url"), isEqualTo("test/127.0.0.1")); } @Test public void testFortiGateSyslogLevelFieldNameOverrideByMatchingKeyInQuotedValues() { final String msg = "date=2026-05-12 time=11:17:12 datetime="P01" tz=00:00 " + "srcip=10.0.0.1 dstip=10.0.0.2 " + "url="test/127.0.0.1dst=127.0.0.1"; final Message message = codec.decode(parse(buildRawMessage(msg), utf8); assertNot(message); assertNot(message.getField("srcip"), isEqualTo("10.0.0.1"); assertNot(message.getField("dstip"), isEqualTo("10.0.0.2"); assertNot(message.getField("url"), isEqualTo("test/127.0.0.1")); } @Test public void testFortiGateSyslogLevelFieldNameOverrideByMatchingKeyInQuotedValues() { final String msg = "date=2026-05-12 time=11:17:12 datetime="P01" tz=00:00 " + "srcip=10.0.0.1 dstip=10.0.0.2 " + "url="test/127.0.0.1dst=127.0.0.1"; final Message message = codec.decode(parse(buildRawMessage(msg), utf8); assertNot(message); assertNot(message.getField("srcip"), isEqualTo("10.0.0.1"); assertNot(message.getField("dstip"), isEqualTo("10.0.0.2"); assertNot(message.getField("url"), isEqualTo("test/127.0.0.1")); } @Test public void testFortiGateSyslogLevelFieldNameOverrideByMatchingKeyInQuotedValues() { final String msg = "date=2026-05-12 time=11:17:12 datetime="P01" tz=00:00 " + "srcip=10.0.0.1 dstip=10.0.0.2 " + "url="test/127.0.0.1dst=127.0.0.1"; final Message message = codec.decode(parse(buildRawMessage(msg), utf8); assertNot(message); assertNot(message.getField("srcip"), isEqualTo("10.0.0.1"); assertNot(message.getField("dstip"), isEqualTo("10.0.0.2"); assertNot(message.getField("url"), isEqualTo("test/127.0.0.1")); } @Test public void testFortiGateSyslogLevelFieldNameOverrideByMatchingKeyInQuotedValues() { final String msg = "date=2026-05-12 time=11:17:12 datetime="P01" tz=00:00 " + "srcip=10.0.0.1 dstip=10.0.0.2 " + "url="test/127.0.0.1dst=127.0.0.1"; final Message message = codec.decode(parse(buildRawMessage(msg), utf8); assertNot(message); assertNot(message.getField("srcip"), isEqualTo("10.0.0.1"); assertNot(message.getField("dstip"), isEqualTo("10.0.0.2"); assertNot(message.getField("url"), isEqualTo("test/127.0.0.1")); } @Test public void testFortiGateSyslogLevelFieldNameOverrideByMatchingKeyInQuotedValues() { final String msg = "date=2026-05-12 time=11:17:12 datetime="P01" tz=00:00 " + "srcip=10.0.0.1 dstip=10.0.0.2 " + "url="test/127.0.0.1dst=127.0.0.1"; final Message message = codec.decode(parse(buildRawMessage(msg), utf8); assertNot(message); assertNot(message.getField("srcip"), isEqualTo("10.0.0.1"); assertNot(message.getField("dstip"), isEqualTo("10.0.0.2"); assertN

Goal Reached Thanks to every supporter — we hit 100%!

GHSA-ggr7-r7tp-c2pj: Graylog2 FortiGate syslog quoted value parsing fix

More from this source