Bug 2142460 (CVE-2022-39379) - CVE-2022-39379 fluentd: remote code execution via crafted JSON payloads
Summary: CVE-2022-39379 fluentd: remote code execution via crafted JSON payloads
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2022-39379
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2148820 2148822 2148818 2148819
Blocks: 2139606
TreeView+ depends on / blocked
 
Reported: 2022-11-14 05:03 UTC by Avinash Hanwate
Modified: 2022-11-30 07:04 UTC (History)
15 users (show)

Fixed In Version: fluentd 1.15.3
Doc Type: If docs needed, set a value
Doc Text:
A remote code execution (RCE) vulnerability was found in non-default configurations of Fluentd. This issue allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads.
Clone Of:
Environment:
Last Closed: 2022-11-24 06:44:41 UTC


Attachments (Terms of Use)

Description Avinash Hanwate 2022-11-14 05:03:12 UTC
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.

https://github.com/fluent/fluentd/commit/48e5b85dab1b6d4c273090d538fc11b3f2fd8135
https://github.com/fluent/fluentd/security/advisories/GHSA-fppq-mj76-fpj2

Comment 2 Avinash Hanwate 2022-11-28 04:37:24 UTC
Created golang-github-docker tracking bugs for this issue:

Affects: fedora-35 [bug 2148819]
Affects: fedora-36 [bug 2148820]
Affects: fedora-37 [bug 2148818]


Created puppet-fluentd tracking bugs for this issue:

Affects: openstack-rdo [bug 2148822]


Note You need to log in before you can comment on or make changes to this bug.