GHSA-fppq-mj76-fpj2LowCVSS 3.1

fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)

Published
November 2, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-39379 →

📋 Description

Impact

A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads.

Fluentd setups are only affected if the environment variable FLUENT_OJ_OPTION_MODE is explicitly set to object.

Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability.

Patches

v1.15.3

Workarounds

Do not use FLUENT_OJ_OPTION_MODE=object.

References

  • GHSL-2022-067

🎯 Affected products1

  • rubygems/fluentd:>= 1.13.2, < 1.15.3

🔗 References (6)