Bug 1955760 (CVE-2020-35963) - CVE-2020-35963 fluent-bit: Out of bounds write in flb_gzip_compress in flb_gzip.c
Summary: CVE-2020-35963 fluent-bit: Out of bounds write in flb_gzip_compress in flb_gz...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-35963
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1955762
TreeView+ depends on / blocked
 
Reported: 2021-04-30 18:17 UTC by Pedro Sampaio
Modified: 2021-05-11 20:33 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2021-05-11 20:33:52 UTC
Embargoed:

Attachments (Terms of Use)

Description Pedro Sampaio 2021-04-30 18:17:21 UTC 
flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-size expansion.

References:

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-35963
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27261
https://github.com/fluent/fluent-bit/commit/cadff53c093210404aed01c4cf586adb8caa07af
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35963
https://fluentbit.io/announcements/v1.6.4/
Comment 1 Product Security DevOps Team 2021-05-11 20:33:52 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-35963
Note You need to log in before you can comment on or make changes to this bug.