GitHub Advisoryadvisory · RubyGems
GHSA-5jrp-w8fr-mrww Fluentd Escape Sequence Injection Vulnerability
CRITICAL
Official page ↗
- Aliases
- CVE-2017-10906
- Ecosystem
- RubyGems
- Packages
- fluentd
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Reviewed
- 2023-01-24
Affected packages
• RubyGems fluentd: >= 0.12.29, < 0.12.41 → fixed in 0.12.41
Description
Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.
Related
Alias · CVE (1)
- CVE-2017-10906 Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-10906 advisory
- https://github.com/fluent/fluentd/pull/1733 web
- https://access.redhat.com/errata/RHSA-2018:2225 web
- https://github.com/fluent/fluentd package
- https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes web
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fluentd/CVE-2017-10906.yml web
- https://jvn.jp/en/vu/JVNVU95124098/index.html web