PT-2023-12598 · Treasure Data · Treasure Data Fluent Bit

Name of the Vulnerable Software and Affected Versions: Treasure Data Fluent Bit version 1.7.1 Description: An issue was discovered in Treasure Data Fluent Bit, where erroneous parsing in flb pack msgpack to json format leads to a type confusion bug. This bug interprets whatever is on the stack as...

PT-2023-12599 · Treasure Data · Treasure Data Fluent Bit

Name of the Vulnerable Software and Affected Versions: Treasure Data Fluent Bit version 1.7.1 Description: An issue was discovered in Treasure Data Fluent Bit, where a wrong variable is used to get the msgpack data, resulting in a heap overflow in flb msgpack gelf value ext. An attacker can craft...

fluent-bit:flb-it-fuzz-filter_stdout_fuzzer_OSSFUZZ: Heap-use-after-free in template_execute

Detailed Report: https://oss-fuzz.com/testcase?key=6009092202430464 Project: fluent-bit Fuzzing Engine: libFuzzer Fuzz Target: flb-it-fuzz-filterstdoutfuzzerOSSFUZZ Job Type: libfuzzerasanfluent-bit Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x7fc6c87c7ff0 Crash Stat...

PT-2022-36776 · Git +1 · Fluent-Bit

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-use-after-free error, which occurs when the program attempts to access memory that has already been freed. The crash state...

Denial Of Service (DoS)

github.com/shamaton/msgpack is vulnerable to denial of serviceDoS attacks. A remote attacker is able to cause an application crash in Unmarshal functionality, via a maliciously crafted input...

CVE-2022-41719 Panic in github.com/shamaton/msgpack/v2

Unmarshal can panic on some inputs, possibly allowing for denial of service attacks...

GO-2022-0972 Panic in github.com/shamaton/msgpack/v2

Unmarshal can panic on some inputs, possibly allowing for denial of service attacks...

Msgpack security vulnerabilities

Msgpack is open source an efficient binary serialization format . It allows you to exchange data between multiple languages such as JSON. But it's faster and smaller. Small integers are encoded as one byte, and typical short strings require only one extra byte in addition to the string itself...

PT-2022-36860

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack-buffer-overflow read crash. The crash occurs in the msgpack sbuffer write function, which is called by flb pack msgpack to...

GHSA-MX67-WV8X-HVV9 Deserialization of Untrusted Data in msgpack

Withdrawn This advisory was withdrawn by its CNA Snyk. Original advisory All versions of package msgpack are vulnerable to Deserialization of Untrusted Data via the unpack function. This does not affect the similarly named package @msgpack/msgpack...

Deserialization of Untrusted Data in msgpack

Withdrawn This advisory was withdrawn by its CNA Snyk. Original advisory All versions of package msgpack are vulnerable to Deserialization of Untrusted Data via the unpack function. This does not affect the similarly named package @msgpack/msgpack...

Exploit for CVE-2021-23410

Test for https://snyk.io/vuln/SNYK-JS-MSGPACK-1296122 This look...

PT-2021-15500

Name of the Vulnerable Software and Affected Versions msgpack versions all Description The issue concerns Deserialization of Untrusted Data via the unpack function. This affects the NPM package msgpack only, and not the similarly named package @msgpack/msgpack. Recommendations For msgpack version...

openSUSE: Security Advisory for salt (openSUSE-SU-2021:0899-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2021:0899-1 Security update for salt

This update for salt fixes the following issues: Update to Salt release version 3002.2 jscECO-3212, jscSLE-18033, jscSLE-18028 - Check if dpkgnotify is executable bsc1186674 - Drop support for Python2. Obsoletes python2-salt package jscSLE-18028 - virt module updates network: handle missing ipv4...

SUSE-SU-2021:2106-1 Security update for salt

This update for salt fixes the following issues: Update to Salt release version 3002.2 jscECO-3212, jscSLE-18033, jscSLE-18028 - Check if dpkgnotify is executable bsc1186674 - Drop support for Python2. Obsoletes python2-salt package jscSLE-18028 - virt module updates network: handle missing ipv4...

SUSE-SU-2021:1690-1 Security Beta update for Salt

This update fixes the following issues: salt: - Update to Salt release version 3002.2 jscECO-3212 - Drop support for Python2. Obsoletes 'python2-salt' package - Virt module updates network: handle missing ipv4 netmask attribute more network support PCI/USB host devices passthrough support - Set...

Deserialization of Untrusted Data

Amendment This was deemed not a vulnerability. Overview msgpack is an A space-efficient object serialization library for node.js Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the unpack function. N.B: this affects the NPM package msgpack only, NOT the...

CVE-2021-21368

msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a "Prototype Poisoning" vulnerability. When msgpack5 decodes a map containing a key "proto", it assigns the decoded value to proto. Object.prototype.proto is an access...

fluent-bit:flb-it-fuzz-flb_json_fuzzer_OSSFUZZ: Crash in msgpack_sbuffer_write

Project: https://github.com/fluent/fluent-bit.git Detailed Report: https://oss-fuzz.com/testcase?key=5667190028238848 Project: fluent-bit Fuzzing Engine: libFuzzer Fuzz Target: flb-it-fuzz-flbjsonfuzzerOSSFUZZ Job Type: libfuzzerubsanfluent-bit Platform Id: linux Crash Type: UNKNOWN READ Crash...