CVE-2017-10906: Command Injection
Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.
Other sources
Escape sequence injection vulnerability in the filterparser.rb:filterstream function of Fluentd versions 0.12.29 through 0.12.40 may allow for unescaped arbitrary command injection to log files and terminal output.
Processing a specially crafted log may allow for arbitrary command exectuion on the device collecting logs.
References: https://nvd.nist.gov/vuln/detail/CVE-2017-10906 https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes https://github.com/fluent/fluentd/pull/1733 https://jvn.jp/en/vu/JVNVU95124098/index.html
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-10906?
CVE-2017-10906 has a medium severity level as it allows for potential execution of arbitrary commands.
How do I fix CVE-2017-10906?
To remediate CVE-2017-10906, upgrade Fluentd to versions 0.12.41 or later.
What are the affected versions of Fluentd for CVE-2017-10906?
Fluentd versions 0.12.29 through 0.12.40 are affected by CVE-2017-10906.
Can CVE-2017-10906 allow attackers access to sensitive data?
While CVE-2017-10906 primarily impacts the terminal UI, it may lead to unauthorized command execution, posing risks to sensitive data.
What components of Fluentd are affected by CVE-2017-10906?
CVE-2017-10906 affects the filter_parser.rb in the filter_stream function within Fluentd.