CVE-2024-26455

fluent-bit 2.2.2 contains a Use-After-Free vulnerability in /fluent-bit/plugins/customcalyptia/calyptia.c...

CVE-2024-26455: Use After Free

fluent-bit 2.2.2 contains a Use-After-Free vulnerability in /fluent-bit/plugins/customcalyptia/calyptia.c...

PT-2024-21382 · Unknown · Fluent-Bit

Name of the Vulnerable Software and Affected Versions: fluent-bit version 2.2.2 Description: The issue is a Use-After-Free vulnerability located in the /fluent-bit/plugins/custom calyptia/calyptia.c file. Recommendations: For fluent-bit version 2.2.2, consider disabling the custom calyptia plugin...

CVE-2024-26455

The fluent-bit software version 2.2.2 is vulnerable to a Use-After-Free vulnerability located in the /fluent-bit/plugins/custom_calyptia/calyptia.c component. This flaw allows for potential high availability impact as indicated by its CVSS score of 7.5. Remediation involves upgrading the package ...

CVE-2024-26455

fluent-bit 2.2.2 contains a Use-After-Free vulnerability in /fluent-bit/plugins/customcalyptia/calyptia.c...

CVE-2024-26455

fluent-bit 2.2.2 contains a Use-After-Free vulnerability in /fluent-bit/plugins/customcalyptia/calyptia.c...

AZL-34687 CVE-2024-25629 affecting package fluent-bit for versions less than 3.0.6-1

c-ares is a C library for asynchronous DNS requests. aresreadline is used to parse local configuration files such as /etc/resolv.conf, /etc/nsswitch.conf, the HOSTALIASES file, and if using a c-ares version prior to 1.27.0, the /etc/hosts file. If any of these configuration files has an embedded...

AZL-34455 CVE-2024-25629 affecting package fluent-bit for versions less than 2.2.3-1

c-ares is a C library for asynchronous DNS requests. aresreadline is used to parse local configuration files such as /etc/resolv.conf, /etc/nsswitch.conf, the HOSTALIASES file, and if using a c-ares version prior to 1.27.0, the /etc/hosts file. If any of these configuration files has an embedded...

CBL Mariner 2.0 Security Update: fluent-bit (CVE-2023-52284)

The version of fluent-bit installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-52284 advisory. - Bytecode Alliance wasm-micro-runtime aka WebAssembly Micro Runtime or WAMR before 1.3.0 can have an doub...

CVE-2023-52284 affecting package fluent-bit for versions less than 2.1.10-3

CVE-2023-52284 affecting package fluent-bit for versions less than 2.1.10-3. A patched version of the package is available...

AZL-32276 CVE-2023-52284 affecting package fluent-bit for versions less than 2.1.10-3

Bytecode Alliance wasm-micro-runtime aka WebAssembly Micro Runtime or WAMR before 1.3.0 can have an "double free or corruption" error for a valid WebAssembly module because pushpopframerefoffset is mishandled...

CVE-2023-48105 affecting package fluent-bit for versions less than 2.1.10-2

CVE-2023-48105 affecting package fluent-bit for versions less than 2.1.10-2. A patched version of the package is available...

AZL-32060 CVE-2023-48105 affecting package fluent-bit for versions less than 2.1.10-2

An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 allows a remote attacker to cause a denial of service via the wasmloaderpreparebytecode function in core/iwasm/interpreter/wasmloader.c...

PT-2023-35572 · Git +1 · Fluent-Bit

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash, specifically a Segv on an unknown address. The crash involves the functions flb sds cat safe, flb cf key translate, and...

CVE-2023-32067 affecting package fluent-bit for versions less than 2.1.10-1

CVE-2023-32067 affecting package fluent-bit for versions less than 2.1.10-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-31130 affecting package fluent-bit for versions less than 2.1.10-1

CVE-2023-31130 affecting package fluent-bit for versions less than 2.1.10-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-31147 affecting package fluent-bit for versions less than 2.1.10-1

CVE-2023-31147 affecting package fluent-bit for versions less than 2.1.10-1. An upgraded version of the package is available that resolves this issue...

AZL-26918 CVE-2023-32067 affecting package fluent-bit for versions less than 2.1.10-1

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful...

AZL-26870 CVE-2023-31147 affecting package fluent-bit for versions less than 2.1.10-1

c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom are unavailable, c-ares uses rand to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand so will generate predictable output. Input from the random number generator i...

AZL-26917 CVE-2023-31130 affecting package fluent-bit for versions less than 2.1.10-1

c-ares is an asynchronous resolver library. aresinetnetpton is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to...