GitHub Advisoryadvisory · RubyGems

GHSA-fppq-mj76-fpj2 fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)

LOW Published 2022-11-02 Modified 2022-11-02 Official page ↗
Aliases
CVE-2022-39379
Ecosystem
RubyGems
Packages
fluentd
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-502
Reviewed
2022-11-02

Affected packages

• RubyGems fluentd: >= 1.13.2, < 1.15.3 → fixed in 1.15.3

Description

Impact A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. Patches v1.15.3 Workarounds Do not use `FLUENT_OJ_OPTION_MODE=object`. References • GHSL-2022-067

Related

Alias · CVE (1)

  • CVE-2022-39379 Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References