[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <c3748619-bb6f-4670-986d-613bd1404751@greenbone.net>
Date: Wed, 3 Dec 2025 13:43:40 +0100
From: Christian Fischer <christian.fischer@...enbone.net>
To: oss-security@...ts.openwall.com
Subject: Re: 5 CVE's fixed in Fluent Bit
On 12/2/25 4:56 PM, Christian Brabandt wrote:
> Well, I have asked upstream
> https://github.com/fluent/fluent-bit/issues/11230 and they have
> confirmed and updated the blog post[1] to mention 4.0.13 as the proper
> backported fix.
>
> I did not check or even verify the other versions.
Thanks a lot for the reference, this was a missing link so far.
As it only includes "I think it should be 4.0.13" and as i noticed that
the linked blog post includes links to the relevant pull requests on
GitHub i did a short own analysis here (also attached as plain text for
archiving purposes):
https://github.com/fluent/fluent-bit/issues/11230#issuecomment-3606609133
My initial assumption/assessment is that four out of the five issues /
CVEs are actually already fixed in 4.0.12 while one requires 4.0.13 for
a "full" fix and 4.1.1 is currently still partly affected by that one.
I have forwarded this information to the Fluent Bit Security Team and
asked them to publish official advisories for these CVEs as this could
largely clear up some confusion / inconsistencies on the affected and
fixed versions.
View attachment "fluentbit_analysis.txt" of type "text/plain" (1776 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
