PT-2017-11598 · Treasure Data · Fluentd

Teppei Fukuda · Published 2017-12-08 · Updated 2022-05-13 · CVE-2017-10906

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fluentd versions 0.12.29 through 0.12.40

Description The issue allows an attacker to potentially change the terminal UI or execute arbitrary commands on the device via unspecified vectors.

Recommendations For Fluentd versions 0.12.29 through 0.12.40, update to a version outside of this range to mitigate the risk.

Exploit

Fix

Related Identifiers

CVE-2017-10906

GHSA-5JRP-W8FR-MRWW

RHSA-2018:2225

Affected Products

Fluentd

References · 10

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fluentd/CVE-2017-10906.yml · Exploit
• https://github.com/fluent/fluentd/pull/1733 · Patch
• https://osv.dev/vulnerability/CVE-2017-10906 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-10906 · Security Note
• https://osv.dev/vulnerability/GHSA-5jrp-w8fr-mrww · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2225 · Vendor Advisory
• https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes · Note
• https://github.com/fluent/fluentd · Note
• https://jvn.jp/en/vu/JVNVU95124098/index.html · Note
• https://t.me/cvenotify/18650 · Telegram Post