CVE-2021-46879

An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to get the msgpack data resulting in a heap overflow in flbmsgpackgelfvalueext. An attacker can craft a malicious file and tick the victim to open the file with the software, triggering a heap overflow and execute...

Type confusion

An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flbpackmsgpacktojsonformat leads to type confusion bug that interprets whatever is on the stack as msgpack maps and arrays, leading to use-after-free. This can be used by an attacker to craft a specially craft file an...

CVE-2021-46878

An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flbpackmsgpacktojsonformat leads to type confusion bug that interprets whatever is on the stack as msgpack maps and arrays, leading to use-after-free. This can be used by an attacker to craft a specially craft file an...

CVE-2021-46879

An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to get the msgpack data resulting in a heap overflow in flbmsgpackgelfvalueext. An attacker can craft a malicious file and tick the victim to open the file with the software, triggering a heap overflow and execute...

Fluent Bit 安全漏洞

Fluent Bit is an open source log processing and analyzing system written in C. A security vulnerability exists in Treasure Data Fluent Bit version 1.7.1, which stems from the presence of a type-obfuscation error that leads to post-release reuse and can be exploited by an attacker to execute...

PT-2023-12598 · Treasure Data · Treasure Data Fluent Bit

Name of the Vulnerable Software and Affected Versions: Treasure Data Fluent Bit version 1.7.1 Description: An issue was discovered in Treasure Data Fluent Bit, where erroneous parsing in flb pack msgpack to json format leads to a type confusion bug. This bug interprets whatever is on the stack as...

PT-2023-12599 · Treasure Data · Treasure Data Fluent Bit

Name of the Vulnerable Software and Affected Versions: Treasure Data Fluent Bit version 1.7.1 Description: An issue was discovered in Treasure Data Fluent Bit, where a wrong variable is used to get the msgpack data, resulting in a heap overflow in flb msgpack gelf value ext. An attacker can craft...

CVE-2021-46879

The CVE-2021-46879 issue affects Treasure Data Fluent Bit 1.7.1. A wrong variable is used when reading msgpack data, causing a heap overflow in flb_msgpack_gelf_value_ext. This can be triggered by a crafted file opened with Fluent Bit, potentially allowing arbitrary code execution on the target s...

CVE-2021-46878

Treasure Data Fluent Bit 1.7.1 is affected. The vulnerability stems from an error in flb_pack_msgpack_to_json_format that causes type confusion by interpreting stack data as msgpack maps/arrays, leading to use-after-free. This could allow an attacker to craft a specially crafted file and trigger ...

CVE-2021-46878

An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flbpackmsgpacktojsonformat leads to type confusion bug that interprets whatever is on the stack as msgpack maps and arrays, leading to use-after-free. This can be used by an attacker to craft a specially craft file an...

CVE-2021-46879

An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to get the msgpack data resulting in a heap overflow in flbmsgpackgelfvalueext. An attacker can craft a malicious file and tick the victim to open the file with the software, triggering a heap overflow and execute...

Fluent Bit 缓冲区错误漏洞

Fluent Bit is an open source log processing and analyzing system written in C. A security vulnerability exists in Treasure Data Fluent Bit version 1.7.1, which stems from the presence of a heap overflow that can be exploited by an attacker to execute arbitrary code on the target system...

CBL Mariner 2.0 Security Update: fluent-bit / hvloader (CVE-2021-36647)

The version of fluent-bit / hvloader installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-36647 advisory. - Use of a Broken or Risky Cryptographic Algorithm in the function mbedtlsmpiexpmod in lignum.c...

CBL Mariner 2.0 Security Update: fluent-bit (CVE-2022-46392)

The version of fluent-bit installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-46392 advisory. - An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to...

CVE-2022-46392 affecting package fluent-bit for versions less than 2.0.9-1

CVE-2022-46392 affecting package fluent-bit for versions less than 2.0.9-1. An upgraded version of the package is available that resolves this issue...

SUSE CVE-2020-35963

flbgzipcompress in flbgzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-size expansion...

AZL-13023 CVE-2021-36647 affecting package fluent-bit for versions less than 2.0.9-1

Use of a Broken or Risky Cryptographic Algorithm in the function mbedtlsmpiexpmod in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or 2.16.11 allows attackers with access to precise enough timing and memory access information typically an untrusted operating system attacking a...

AZL-12968 CVE-2022-46392 affecting package fluent-bit for versions less than 2.0.9-1

An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses typically, an untrusted operating system attacking a secure enclave can recover an RSA private key after observing the victim performing a single...

PT-2022-36767 · Git +1 · Fluent-Bit

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-use-after-free READ 8 crash type. The crash state involves functions such as output thread, step callback, and flb task...

PT-2022-36737 · Git +1 · Fluent-Bit

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read crash. Technical details include a crash type of Heap-buffer-overflow READ 8, with a crash state...