NXLog Agent OpenSSL Configuration File Loading Vulnerability

A vulnerability exists in NXLog Agent versions prior to 6.11, allowing the agent to load a file specified by the OPENSSL_CONF environment variable. This could enable unintended modifications to OpenSSL's configuration, potentially leading to security risks.

Impact

Exploitation of this vulnerability could cause OpenSSL to improperly load configurations, possibly leading to misconfigurations or security weaknesses in applications relying on OpenSSL.

Remediation

Users can upgrade to NXLog Agent version 6.11 or later, where this vulnerability has been addressed. Instructions for updating NXLog Agent can be found in the NXLog Agent Reference Manual.