Bug 2142460 (CVE-2022-39379)

Summary:	CVE-2022-39379 fluentd: remote code execution via crafted JSON payloads
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	eglynn, jbadiapa, jcantril, jjoyce, jschluet, lars, lhh, mburns, mgarciac, mmagr, mrunge, mrunge, periklis, slinaber, spower, tvignaud
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	fluentd 1.15.3	Doc Type:	If docs needed, set a value
Doc Text:	A remote code execution (RCE) vulnerability was found in non-default configurations of Fluentd. This issue allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-11-24 06:44:41 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2148818, 2148819, 2148820, 2148822
Bug Blocks:	2139606

Description Avinash Hanwate 2022-11-14 05:03:12 UTC

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.

https://github.com/fluent/fluentd/commit/48e5b85dab1b6d4c273090d538fc11b3f2fd8135
https://github.com/fluent/fluentd/security/advisories/GHSA-fppq-mj76-fpj2

Comment 2 Avinash Hanwate 2022-11-28 04:37:24 UTC

Created golang-github-docker tracking bugs for this issue:

Affects: fedora-35 [bug 2148819]
Affects: fedora-36 [bug 2148820]
Affects: fedora-37 [bug 2148818]


Created puppet-fluentd tracking bugs for this issue:

Affects: openstack-rdo [bug 2148822]