CVE-2017-10906

CRITICAL9.8EPSS 1.4%

Fluentd Escape Sequence Injection Vulnerability

發布日:2022/5/13修改日:2024/12/5

描述

Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.

受影響套件(1)

RubyGems/fluentd>= 0.12.29, < 0.12.41

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2017-10906
PATCHhttps://github.com/fluent/fluentd
WEBhttps://access.redhat.com/errata/RHSA-2018:2225
WEBhttps://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes
WEBhttps://github.com/fluent/fluentd/pull/1733
WEBhttps://github.com/rubysec/ruby-advisory-db/blob/master/gems/fluentd/CVE-2017-10906.yml
WEBhttps://jvn.jp/en/vu/JVNVU95124098/index.html