oss-security - Re: 5 CVE's fixed in Fluent Bit

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aS8MFknR8ZPxcniJ@256bit.org>
Date: Tue, 2 Dec 2025 16:56:06 +0100
From: Christian Brabandt <cb@...bit.org>
To: oss-security@...ts.openwall.com
Subject: Re: 5 CVE's fixed in Fluent Bit


On Di, 02 Dez 2025, Christian Fischer wrote:

> there seems to be indeed some confusion/inconsistencies about the possible
> fixes:
> 1. [1] lists 4.2, 4.1.1 and 4.0.14 as fixes
> 2. [2] lists 4.0.12, 4.1.1 and 4.2.0 as fixes
> 3. In this thread 4.0.13 (among 4.1.1 and 4.2.0) is now listed as a fix
> 
> But if we check [3] version 4.0.13 only contains two changelog entries
> shared with version 4.1.1. Furthermore 4.0.12 was released more closely to
> 4.1.1 then 4.0.13 so the fixed versions on [2] might be the correct ones
> (4.0.12, 4.1.1 and 4.2.0).
> 
> Regards,
> 
> [1] https://fluentbit.io/blog/2025/10/28/security-vulnerabilities-addressed-in-fluent-bit-v4.1-and-backported-to-v4.0/
> [2] https://kb.cert.org/vuls/id/761751
> [3] https://github.com/fluent/fluent-bit/releases

Well, I have asked upstream 
https://github.com/fluent/fluent-bit/issues/11230 and they have 
confirmed and updated the blog post[1] to mention 4.0.13 as the proper 
backported fix.

I did not check or even verify the other versions.

Thanks,
Christian
-- 
evakuieren:
  zeigt eindeutig, daß der Menschen erstes Milchvieh "o'muh" sagte.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.