Azure Linux 3.0 Security Update: fluent-bit (CVE-2024-50609)

The version of fluent-bit installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-50609 advisory. - An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listenin...

The vulnerability of the Fluent Bit logging collection and processing tool, related to the swapping of the zero pointer, allows a malicious actor to trigger a service failure.

The vulnerability of the Fluent Bit logging and processing tool is related to the assignment of the zero pointer. Exploiting this vulnerability can allow a malicious actor to cause a service failure through a specially crafted HTTP request...

CVE-2024-50608 affecting package fluent-bit for versions less than 3.1.9-3

CVE-2024-50608 affecting package fluent-bit for versions less than 3.1.9-3. A patched version of the package is available...

CVE-2024-50609 affecting package fluent-bit for versions less than 3.1.9-3

CVE-2024-50609 affecting package fluent-bit for versions less than 3.1.9-3. A patched version of the package is available...

An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL pointer into struct cfl_sds. This is related to process_payload_traces_proto_ng() at opentelemetry_prot.c.

...

An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL pointer into struct cfl_sds. This is related to process_payload_metrics_ng() at prom_rw_prot.c.

...

CVE-2024-50609 affecting package fluent-bit for versions less than 3.0.6-2

CVE-2024-50609 affecting package fluent-bit for versions less than 3.0.6-2. A patched version of the package is available...

CVE-2024-50608 affecting package fluent-bit for versions less than 3.0.6-2

CVE-2024-50608 affecting package fluent-bit for versions less than 3.0.6-2. A patched version of the package is available...

CBL Mariner 2.0 Security Update: fluent-bit (CVE-2024-50608)

The version of fluent-bit installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-50608 advisory. - An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running an...

Fluent Bit Multiple Vulnerabilities

The version of Fluent Bit running on the remote host is prior to 3.2.7. It is, therefore, is affected by multiple vulnerabilities: - An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet...

The vulnerability of the Prometheus Remote Write plugin for collecting and processing Fluent Bit logs, related to the assignment of a zero pointer, allows a malicious actor to trigger a service failure.

The vulnerability of the Prometheus Remote Write plugin for collecting and processing Fluent Bit logs is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure by sending a specially crafted HTTP request...

GHSA-68MR-468G-4WMG vulnerabilities

Vulnerabilities for packages: fluent-bit...

GHSA-68MR-468G-4WMG vulnerabilities

Vulnerabilities for packages: fluent-bit...

GHSA-3F6R-QH9C-X6MM vulnerabilities

Vulnerabilities for packages: amazon-k8s-cni, lvm-driver, node-feature-discovery, harbor-registry-fips, nats, aws-efs-csi-driver, supercronic, prometheus-node-exporter-fips, secrets-store-csi-driver-provider-gcp, kapp, elvish, x509-certificate-exporter, s5cmd, paranoia, prometheus-alertmanager,...

CVE-2024-50608

An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user with access t...

CVE-2024-50609

An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user with access to the...

AZL-57092 CVE-2024-50608 affecting package fluent-bit for versions less than 3.0.6-2

An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user with access t...

AZL-57078 CVE-2024-50609 affecting package fluent-bit for versions less than 3.1.9-3

An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user with access to the...

AZL-57086 CVE-2024-50609 affecting package fluent-bit for versions less than 3.0.6-2

An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user with access to the...

AZL-57074 CVE-2024-50608 affecting package fluent-bit for versions less than 3.1.9-3

An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user with access t...