CVE-2021-27186: Null Pointer Dereference
Published Feb 10, 2021
·Updated
Fluent Bit 1.6.10 has a NULL pointer dereference when an flbmalloc return value is not validated by flbavro.c or httpserver/api/v1/metrics.c.
Affected Software
1 affected component
Treasuredata Fluent Bit=1.6.10
Remediation
Patch Available
Patch Available
Event History
Feb 10, 2021
CVE Published
via MITRE·09:24 PM
Data Sourced
via MITRE·09:24 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2021-27186?
CVE-2021-27186 is classified as a medium severity vulnerability.
2
How do I fix CVE-2021-27186?
To fix CVE-2021-27186, upgrade Fluent Bit to version 1.6.11 or later.
3
What causes the vulnerability CVE-2021-27186?
CVE-2021-27186 is caused by a NULL pointer dereference due to unvalidated return values from flb_malloc.
4
Which versions of Fluent Bit are affected by CVE-2021-27186?
CVE-2021-27186 specifically affects Fluent Bit version 1.6.10.
5
Is CVE-2021-27186 a remote code execution vulnerability?
CVE-2021-27186 does not allow for remote code execution; it leads to a crash due to a NULL pointer dereference.