[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2362c3be-360c-413b-be59-d15dd682deee@oracle.com>
Date: Wed, 26 Nov 2025 12:28:45 -0800
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: 5 CVE's fixed in Fluent Bit
https://www.oligo.security/blog/critical-vulnerabilities-in-fluent-bit-expose-cloud-environments-to-remote-takeover
reports these newly disclosed vulnerabilities in Fluent Bit:
> * CVE-2025-12972: Unsanitized tag values are used to generate output
> filenames, allowing attackers to inject path-traversal sequences
> like “../” to write or overwrite arbitrary files on disk, enabling
> log tampering and, in many configurations, full remote code
> execution.
>
> * CVE-2025-12970: A stack buffer overflow in the Docker input enables
> attackers to trigger crashes or execute code by creating containers
> with excessively long names, giving them control over the Fluent Bit
> agent on the host.
>
> * CVE-2025-12978: A flaw in Fluent Bit’s tag-matching logic lets
> attackers spoof trusted tags by guessing only the first character of
> a Tag_Key, enabling them to reroute logs, bypass filters, and inject
> malicious or misleading records.
>
> * CVE-2025-12977: Tags derived from user-controlled fields bypass
> sanitization, allowing attackers to inject newlines, traversal
> sequences, and control characters that corrupt downstream logs or
> enable broader output-based attacks.
>
> * CVE-2025-12969: Fluent Bit forwarders configured with Security.Users
> silently disable authentication, allowing remote attackers to send
> logs, inject false telemetry, or flood detection systems despite
> appearing secured.
https://fluentbit.io/blog/2025/10/28/security-vulnerabilities-addressed-in-fluent-bit-v4.1-and-backported-to-v4.0/
provides their analysis and information about fixes in versions 4.2, 4.1.1,
and 4.0.14, which are available from https://github.com/fluent/fluent-bit .
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
