PT-2023-12599 · Treasure Data · Treasure Data Fluent Bit

CVE-2021-46879 · Publicado 2023-04-11 · Atualizado 2025-02-11

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Treasure Data Fluent Bit version 1.7.1

Description An issue was discovered in Treasure Data Fluent Bit, where a wrong variable is used to get the msgpack data, resulting in a heap overflow in flb msgpack gelf value ext. An attacker can craft a malicious file and trick the victim into opening the file with the software, triggering a heap overflow and executing arbitrary code on the target system.

Recommendations For Treasure Data Fluent Bit version 1.7.1, consider disabling the flb msgpack gelf value ext function until a patch is available to prevent the heap overflow and potential code execution. Restrict access to potentially malicious files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

BIT-FLUENT-BIT-2021-46879

CVE-2021-46879

Produtos afetados

Treasure Data Fluent Bit

Referências · 7

• 🔥 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26851 · Exploit
• https://github.com/fluent/fluent-bit/pull/3100 · Correção
• https://osv.dev/vulnerability/BIT-fluent-bit-2021-46879 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2021-46879 · Nota de Segurança
• https://t.me/cvenotify/110933 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2021-46879 · Aviso do Fabricante
• https://t.me/cibsecurity/61909 · Publicação no Telegram