BIT-fluentd-2021-41186

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/fluentd/BIT-fluentd-2021-41186.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-fluentd-2021-41186

Aliases

Published

2024-03-06T10:52:03Z

Modified

2026-09-08T08:47:10Z

Summary

ReDoS vulnerability in parser_apache2

Details

Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two workarounds available. Either don't use parser_apache2 for parsing logs (which cannot guarantee generated by Apache), or put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable FLUENT_PLUGIN or --plugin option of fluentd).

Database specific

{
    "cpes": [
        "cpe:2.3:a:fluentd:fluentd:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}

References

Affected packages

Bitnami / fluentd

Package

Name: fluentd
Purl: pkg:bitnami/fluentd

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0.14.14

Fixed

1.14.2

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/fluentd/BIT-fluentd-2021-41186.json"