A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads.
Fluentd setups are only affected if the environment variable FLUENT_OJ_OPTION_MODE
is explicitly set to object
.
Please note: The option FLUENTOJOPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability.
v1.15.3
Do not use FLUENT_OJ_OPTION_MODE=object
.