~ / search / GHSA-fppq-mj76-fpj2

GHSA-fppq-mj76-fpj2

fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)

Source: GitHub Advisory Database (reviewed) Low CVE-2022-39379

Packages

EcosystemPackageAffectedFixed in
RubyGems fluentd >= 1.13.2, < 1.15.3 1.15.3

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. ### Patches v1.15.3 ### Workarounds Do not use `FLUENT_OJ_OPTION_MODE=object`. ### References * GHSL-2022-067

References

External links from the advisory. They lead to third-party sites.