Vulnerability Description
A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3. This issue lies in the embedded http server’s parsing of trace requests and may result in denial of service conditions, information disclosure, or remote code execution.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Treasuredata | Fluent Bit | >= 2.0.7, < 2.2.3 |
Related Weaknesses (CWE)
References
- https://github.com/fluent/fluent-bit/commit/9311b43a258352797af40749ab31a63c32acPatch
- https://tenable.com/security/research/tra-2024-17PatchThird Party Advisory
- https://github.com/fluent/fluent-bit/commit/9311b43a258352797af40749ab31a63c32acPatch
- https://tenable.com/security/research/tra-2024-17PatchThird Party Advisory
- https://www.vicarius.io/vsociety/posts/linguistic-lumberjack-memory-corruption-iExploitThird Party Advisory
FAQ
What is CVE-2024-4323?
CVE-2024-4323 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3. This issue lies in the embedded http server’s parsing of trace requests and may result in denial of service conditions, infor...
How severe is CVE-2024-4323?
CVE-2024-4323 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2024-4323?
Check the references section above for vendor advisories and patch information. Affected products include: Treasuredata Fluent Bit.