by Kastro
Paper/Archive/CVE-2024-4323

CVE-2024-4323

Fluent Bit Fluent Bit — Fluent Bit Memory Corruption Vulnerability

EPSS 27%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.1.981 × 2019.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3. This issue lies in the embedded http server’s parsing of trace requests and may result in denial of service conditions, information disclosure, or remote code execution.

Affected

ProductAffectedFixed inSource
Fluent Bit2.0.7 – 3.0.3–CNA
fluent_bit2.0.7 – 3.0.3–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
tenable (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reftenable.com/security/research/tra-2024-17refgithub.com/fluent/fluent-bit/commit/9311b43a258352797af40749ab31a63c32acfd04refvicarius.io/vsociety/posts/linguistic-lumberjack-memory-corruption-in-fluent-bit-cve-2024-4323