PT-2023-12599 · Treasure Data · Treasure Data Fluent Bit

Published 2023-04-11 · Updated 2025-02-11 · CVE-2021-46879

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Treasure Data Fluent Bit version 1.7.1

Description An issue was discovered in Treasure Data Fluent Bit, where a wrong variable is used to get the msgpack data, resulting in a heap overflow in flb msgpack gelf value ext. An attacker can craft a malicious file and trick the victim into opening the file with the software, triggering a heap overflow and executing arbitrary code on the target system.

Recommendations For Treasure Data Fluent Bit version 1.7.1, consider disabling the flb msgpack gelf value ext function until a patch is available to prevent the heap overflow and potential code execution. Restrict access to potentially malicious files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BIT-FLUENT-BIT-2021-46879

CVE-2021-46879

Affected Products

Treasure Data Fluent Bit

References · 7

• 🔥 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26851 · Exploit
• https://github.com/fluent/fluent-bit/pull/3100 · Patch
• https://osv.dev/vulnerability/BIT-fluent-bit-2021-46879 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46879 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46879 · Vendor Advisory
• https://t.me/cvenotify/110933 · Telegram Post
• https://t.me/cibsecurity/61909 · Telegram Post