PT-2019-19841 · Fluent Bit · Fluent-Bit

Publicado 2019-03-13 · Atualizado 2021-07-21 · CVE-2019-9749

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Fluent Bit versions through 1.0.4

Description An issue in the MQTT input plugin, when acting as an MQTT broker, mishandles incoming network messages. After processing a crafted packet, the mqtt packet drop function executes the memmove() function with a negative size parameter, leading to a crash of the Fluent Bit server via a SIGSEGV signal.

Recommendations For Fluent Bit versions through 1.0.4, consider disabling the MQTT input plugin until a patch is available to prevent the server from crashing due to crafted network messages.

Exploit

Correção

Enumeração de Fraquezas

CWE-681

Identificadores relacionados

CVE-2019-9749

Produtos afetados

Fluent-Bit

Referências · 3

• 🔥 https://github.com/fluent/fluent-bit/issues/1135 · Exploit
• https://osv.dev/vulnerability/CVE-2019-9749 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-9749 · Nota de Segurança