CVE-2022-39379: Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable FLUENTOJOPTIONMODE is explicitly set to object. Please note: The option FLUENTOJOPTIONMODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use FLUENTOJOPTIONMODE=object.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-39379?
CVE-2022-39379 is classified as a critical severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2022-39379?
To fix CVE-2022-39379, it is recommended to upgrade Fluentd to versions 1.15.4 or later and ensure default configurations are used.
Who is affected by CVE-2022-39379?
CVE-2022-39379 affects Fluentd versions from 1.13.2 to 1.15.3 and Fedora version 37.
Can CVE-2022-39379 allow unauthorized access to my system?
Yes, CVE-2022-39379 allows unauthenticated attackers to execute arbitrary code on affected systems.
What configurations are at risk with CVE-2022-39379?
Non-default configurations of Fluentd are at risk with CVE-2022-39379, potentially exposing systems to attacks.