GHSA-5jrp-w8fr-mrww CVE-2017-10906
Fluentd Escape Sequence Injection Vulnerability
- Severity
- 9.8 / 10
- Critical · CVSS 3.0
- Exploit chance (EPSS)
- 4.58%
- Chance of exploitation in the next 30 days. Higher than 91.64% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
0.12.41- Upgrade fluentd to this version or later
Description
Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| fluentd | >= 0.12.29, < 0.12.41 |
0.12.41 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
fluentd RubyGems → 0.12.41
- bundler
bundle update fluentd # Gemfile: gem "fluentd", ">= 0.12.41"
Severity breakdown
CVSS 3.0 9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-72f5-rr8c-r6gr Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http` | High | Also affects fluentd |
| GHSA-j9cw-hwqf-85w7 Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward` | High | Also affects fluentd |
| GHSA-pr7j-96cj-549h Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API | High | Also affects fluentd |
| GHSA-44hj-4m45-frj3 Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder | Critical | Also affects fluentd |
| GHSA-fppq-mj76-fpj2 fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration) | Low | Also affects fluentd |
| GHSA-hwhf-64mh-r662 ReDoS vulnerability in parser_apache2 | Medium | Also affects fluentd |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor