fluentd (RubyGems)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 1.19.3 or later clears every advisory below that has a fix.

Upgrade commands

bundler

bundle update fluentd # Gemfile: gem "fluentd", ">= 1.19.3"

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-72f5-rr8c-r6gr Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`	High EPSS 0.44%	`< 1.19.3`	`1.19.3`
GHSA-j9cw-hwqf-85w7 Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`	High EPSS 0.62%	`< 1.19.3`	`1.19.3`
GHSA-pr7j-96cj-549h Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API	High EPSS 0.47%	`< 1.19.3`	`1.19.3`
GHSA-44hj-4m45-frj3 Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder	Critical EPSS 1.08%	`< 1.19.3`	`1.19.3`
GHSA-fppq-mj76-fpj2 fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)	Low EPSS 44.98%	`>= 1.13.2, < 1.15.3`	`1.15.3`
GHSA-5jrp-w8fr-mrww Fluentd Escape Sequence Injection Vulnerability	Critical EPSS 4.58%	`>= 0.12.29, < 0.12.41`	`0.12.41`
GHSA-hwhf-64mh-r662 ReDoS vulnerability in parser_apache2	Medium EPSS 2.21%	`>= 0.14.14, < 1.14.2`	`1.14.2`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor