Bug 2292249 - Upgrade to Fix Critical cve-2024-4323 to upgrade to 2.2.3 or 3.0.4+
Summary: Upgrade to Fix Critical cve-2024-4323 to upgrade to 2.2.3 or 3.0.4+
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: fluent-bit
Version: 39
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Ben Kircher
QA Contact:
URL: https://fluentbit.io/blog/2024/05/21/...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-06-13 17:09 UTC by leoswaldo
Modified: 2024-07-20 03:26 UTC (History)
2 users (show)

Fixed In Version: fluent-bit-3.0.4-1.fc39
Clone Of:
Environment:
Last Closed: 2024-07-20 03:26:02 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)

Description leoswaldo 2024-06-13 17:09:08 UTC 
security vulnerability (known as CVE-2024-4323) that impacts Fluent Bit versions 2.0.7 through 3.0.3. The latest version of Fluent Bit, version 3.0.4, fixes this issue. We’ve also backported  fix to Fluent Bit version 2.2.3, the last release of Fluent Bit v2.


https://fluentbit.io/blog/2024/05/21/statement-on-cve-2024-4323-and-its-fix/

Reproducible: Always
Comment 1 Fedora Update System 2024-07-11 22:53:34 UTC 
FEDORA-2024-f3c8d05888 (fluent-bit-3.0.4-1.fc39) has been submitted as an update to Fedora 39.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-f3c8d05888
Comment 2 Fedora Update System 2024-07-12 04:25:27 UTC 
FEDORA-2024-f3c8d05888 has been pushed to the Fedora 39 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-f3c8d05888`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-f3c8d05888

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Comment 3 Fedora Update System 2024-07-20 03:26:02 UTC 
FEDORA-2024-f3c8d05888 (fluent-bit-3.0.4-1.fc39) has been pushed to the Fedora 39 stable repository.
If problem still persists, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.