fluent-bit:flb-it-fuzz-cmetrics_decode_fuzz_OSSFUZZ: Invalid-free in reset_context

Project: https://github.com/fluent/fluent-bit.git Detailed Report: https://oss-fuzz.com/testcase?key=4737967611314176 Project: fluent-bit Fuzzing Engine: libFuzzer Fuzz Target: flb-it-fuzz-cmetricsdecodefuzzOSSFUZZ Job Type: libfuzzerasanfluent-bit Platform Id: linux Crash Type: Invalid-free Cras...

fluent-bit:flb-it-fuzz-cmetrics_decode_fuzz_OSSFUZZ: Invalid-free in reset_context

Project: https://github.com/fluent/fluent-bit.git Detailed Report: https://oss-fuzz.com/testcase?key=6145488959963136 Project: fluent-bit Fuzzing Engine: afl Fuzz Target: flb-it-fuzz-cmetricsdecodefuzzOSSFUZZ Job Type: aflasanfluent-bit Platform Id: linux Crash Type: Invalid-free Crash Address:...

fluent-bit:flb-it-fuzz-config_random_fuzzer_OSSFUZZ: Heap-buffer-overflow in flb_sds_create_len

Project: https://github.com/fluent/fluent-bit.git Detailed Report: https://oss-fuzz.com/testcase?key=6284604297052160 Project: fluent-bit Fuzzing Engine: libFuzzer Fuzz Target: flb-it-fuzz-configrandomfuzzerOSSFUZZ Job Type: libfuzzerasanfluent-bit Platform Id: linux Crash Type:...

fluent-bit:flb-it-fuzz-filter_stdout_fuzzer_OSSFUZZ: Heap-use-after-free in mk_event_timeout_destroy

Project: https://github.com/fluent/fluent-bit.git Detailed Report: https://oss-fuzz.com/testcase?key=5606055390609408 Project: fluent-bit Fuzzing Engine: libFuzzer Fuzz Target: flb-it-fuzz-filterstdoutfuzzerOSSFUZZ Job Type: libfuzzerasanfluent-bit Platform Id: linux Crash Type: Heap-use-after-fr...

AZL-26918 CVE-2023-32067 affecting package fluent-bit for versions less than 2.1.10-1

c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful...

AZL-26917 CVE-2023-31130 affecting package fluent-bit for versions less than 2.1.10-1

c-ares is an asynchronous resolver library. aresinetnetpton is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to...

AZL-26870 CVE-2023-31147 affecting package fluent-bit for versions less than 2.1.10-1

c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom are unavailable, c-ares uses rand to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand so will generate predictable output. Input from the random number generator i...

CVE-2021-46879 affecting package fluent-bit 1.5.2-2

CVE-2021-46879 affecting package fluent-bit 1.5.2-2. A patched version of the package is available...

CVE-2021-46878 affecting package fluent-bit 1.5.2-2

CVE-2021-46878 affecting package fluent-bit 1.5.2-2. A patched version of the package is available...

Malicious code in fluent-plugin-enhance-k8s-metadata (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 537d9d482d3e99b2757022edbff8c81e9a9bd9bf73f272f10634d355c813e635 The OpenSSF Package Analysis project identified 'fluent-plugin-enhance-k8s-metadata' @ 5.0.1 rubygems as malicious. It is considered malicious...

MAL-2023-1424 Malicious code in fluent-plugin-enhance-k8s-metadata (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 537d9d482d3e99b2757022edbff8c81e9a9bd9bf73f272f10634d355c813e635 The OpenSSF Package Analysis project identified 'fluent-plugin-enhance-k8s-metadata' @ 5.0.1 rubygems as malicious. It is considered malicious...

An issue was discovered in Treasure Data Fluent Bit 1.7.1 erroneous parsing in flb_pack_msgpack_to_json_format leads to type confusion bug that interprets whatever is on the stack as msgpack maps and arrays leading to use-after-free. This can be used by an attacker to craft a specially craft file and trick the victim opening it using the affect software triggering use-after-free and execute arbitrary code on the target system.

...

An issue was discovered in Treasure Data Fluent Bit 1.7.1 a wrong variable is used to get the msgpack data resulting in a heap overflow in flb_msgpack_gelf_value_ext. An attacker can craft a malicious file and tick the victim to open the file with the software triggering a heap overflow and execute arbitrary code on the target system.

...

CVE-2021-46878

An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flbpackmsgpacktojsonformat leads to type confusion bug that interprets whatever is on the stack as msgpack maps and arrays, leading to use-after-free. This can be used by an attacker to craft a specially craft file an...

CVE-2021-46878

An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flbpackmsgpacktojsonformat leads to type confusion bug that interprets whatever is on the stack as msgpack maps and arrays, leading to use-after-free. This can be used by an attacker to craft a specially craft file an...

CVE-2021-46879

An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to get the msgpack data resulting in a heap overflow in flbmsgpackgelfvalueext. An attacker can craft a malicious file and tick the victim to open the file with the software, triggering a heap overflow and execute...

Type confusion

An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flbpackmsgpacktojsonformat leads to type confusion bug that interprets whatever is on the stack as msgpack maps and arrays, leading to use-after-free. This can be used by an attacker to craft a specially craft file an...

CVE-2021-46878

An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flbpackmsgpacktojsonformat leads to type confusion bug that interprets whatever is on the stack as msgpack maps and arrays, leading to use-after-free. This can be used by an attacker to craft a specially craft file an...

CVE-2021-46878

An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flbpackmsgpacktojsonformat leads to type confusion bug that interprets whatever is on the stack as msgpack maps and arrays, leading to use-after-free. This can be used by an attacker to craft a specially craft file an...

CVE-2021-46879

An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to get the msgpack data resulting in a heap overflow in flbmsgpackgelfvalueext. An attacker can craft a malicious file and tick the victim to open the file with the software, triggering a heap overflow and execute...