CVE-2024-50609

An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cflsdslen, which in turn tries to cast a NULL pointer into struct cflsds. This is related to processpayloadtracesprotong() at opentelemetryprot.c.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50609.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / github.com/fluent/fluent-bit

Affected ranges

Type

GIT

Repo

https://github.com/fluent/fluent-bit

Events

Introduced

431fa79ae27edaef8d050a7af6f038f4400193a1

Last affected

431fa79ae27edaef8d050a7af6f038f4400193a1

Database specific

{
    "extracted_events": [
        {
            "introduced": "3.1.9"
        },
        {
            "last_affected": "3.1.9"
        }
    ],
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:treasuredata:fluent_bit:3.1.9:*:*:*:*:*:*:*"
}

Affected versions

3.*

3.1.9

v3.*

v3.1.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-50609.json"