Bug 2142460 (CVE-2022-39379) - CVE-2022-39379 fluentd: remote code execution via crafted JSON payloads
Summary: CVE-2022-39379 fluentd: remote code execution via crafted JSON payloads
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2022-39379
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2148818 2148819 2148820 2148822
Blocks: 2139606
TreeView+ depends on / blocked
 
Reported: 2022-11-14 05:03 UTC by Avinash Hanwate
Modified: 2024-01-29 16:27 UTC (History)
16 users (show)

Fixed In Version: fluentd 1.15.3
Doc Type: If docs needed, set a value
Doc Text:
A remote code execution (RCE) vulnerability was found in non-default configurations of Fluentd. This issue allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads.
Clone Of:
Environment:
Last Closed: 2022-11-24 06:44:41 UTC
Embargoed:

Attachments (Terms of Use)

Description Avinash Hanwate 2022-11-14 05:03:12 UTC 
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.

https://github.com/fluent/fluentd/commit/48e5b85dab1b6d4c273090d538fc11b3f2fd8135
https://github.com/fluent/fluentd/security/advisories/GHSA-fppq-mj76-fpj2
Comment 2 Avinash Hanwate 2022-11-28 04:37:24 UTC 
Created golang-github-docker tracking bugs for this issue:

Affects: fedora-35 [bug 2148819]
Affects: fedora-36 [bug 2148820]
Affects: fedora-37 [bug 2148818]


Created puppet-fluentd tracking bugs for this issue:

Affects: openstack-rdo [bug 2148822]
Note You need to log in before you can comment on or make changes to this bug.