Bug 2292248

Summary:	Upgrade to Fix Critical cve-2024-4323 to upgrade to 2.2.3 or 3.0.4+
Product:	[Fedora] Fedora	Reporter:	leoswaldo <lmaciasm10>
Component:	fluent-bit	Assignee:	leoswaldo <lmaciasm10>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	40	CC:	bkircher, lmaciasm10
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	https://fluentbit.io/blog/2024/05/21/statement-on-cve-2024-4323-and-its-fix/
Whiteboard:
Fixed In Version:	fluent-bit-3.0.4-1.fc40	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-07-20 02:25:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description leoswaldo 2024-06-13 17:07:48 UTC

security vulnerability (known as CVE-2024-4323) that impacts Fluent Bit versions 2.0.7 through 3.0.3. The latest version of Fluent Bit, version 3.0.4, fixes this issue. We’ve also backported  fix to Fluent Bit version 2.2.3, the last release of Fluent Bit v2.


https://fluentbit.io/blog/2024/05/21/statement-on-cve-2024-4323-and-its-fix/


Reproducible: Always

Comment 1 Fedora Update System 2024-07-11 23:13:15 UTC

FEDORA-2024-07db6333b0 (fluent-bit-3.0.4-1.fc40) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-07db6333b0

Comment 2 Fedora Update System 2024-07-12 05:29:38 UTC

FEDORA-2024-07db6333b0 has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-07db6333b0`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-07db6333b0

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 3 Fedora Update System 2024-07-20 02:25:56 UTC

FEDORA-2024-07db6333b0 (fluent-bit-3.0.4-1.fc40) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.