CVE-2025-12977

描述

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tag_key values containing special characters such as newlines or ../ that are treated as valid tags. Because tags influence routing and some outputs derive filenames or contents from tags, this can allow newline injection, path traversal, forged record injection, or log misrouting, impacting data integrity and log routing.

如何修補 CVE-2025-12977

要修補 CVE-2025-12977,請將受影響套件升級到下列已修補版本。

• —升級至 4.1.1 或更新版本

CVE-2025-12977 正在被利用嗎?

低 — EPSS 為 0.6%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 4.1.0, < 4.1.1

CVSS 分數

參考連結(3)

• WEBfluentbit.io/blog/2025/10/28/security-vulnerabilities-addressed-in-fluent-bit-v4.1-and-backported-to-v4.0/
• WEBnvd.nist.gov/vuln/detail/CVE-2025-12977
• WEBwww.oligo.security/blog/critical-vulnerabilities-in-fluent-bit-expose-cloud-environments-to-remote-takeover