CVE-2017-10906 Fluentd Escape Sequence Injection Vulnerability
CriticalCVSS 9.8
EPSS 4.6%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems fluentd(RubyGems) | >= 0.12.29, < 0.12.41 | 0.12.41 |
| rubygems fluentd(RubyGems) | = 0.12.29 | No fix listed |
| rubygems fluentd(RubyGems) | = 0.12.30 | No fix listed |
| rubygems fluentd(RubyGems) | = 0.12.31 | No fix listed |
| rubygems fluentd(RubyGems) | = 0.12.32 | No fix listed |
| rubygems fluentd(RubyGems) | = 0.12.33 | No fix listed |
| rubygems fluentd(RubyGems) | = 0.12.34 | No fix listed |
| rubygems fluentd(RubyGems) | = 0.12.35 | No fix listed |
| rubygems fluentd(RubyGems) | = 0.12.36 | No fix listed |
| rubygems fluentd(RubyGems) | = 0.12.37 | No fix listed |
| rubygems fluentd(RubyGems) | = 0.12.38 | No fix listed |
| rubygems fluentd(RubyGems) | = 0.12.39 | No fix listed |
| rubygems fluentd(RubyGems) | = 0.12.40 | No fix listed |
| fluentd | = 0.12.29 | No fix listed |
| fluentd | = 0.12.30 | No fix listed |
| fluentd | = 0.12.31 | No fix listed |
| fluentd | = 0.12.32 | No fix listed |
| fluentd | = 0.12.33 | No fix listed |
| fluentd | = 0.12.34 | No fix listed |
| fluentd | = 0.12.35 | No fix listed |
| fluentd | = 0.12.36 | No fix listed |
| fluentd | = 0.12.37 | No fix listed |
| fluentd | = 0.12.38 | No fix listed |
| fluentd | = 0.12.39 | No fix listed |
| fluentd | = 0.12.40 | No fix listed |
Show 2 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat openstack | = 13 | No fix listed |
| Cloud Native Computing Foundation (CNCF) Fluentd | = 0.12.29 through 0.12.40 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking patch third-party-advisory
- RHSA-2018:2225 third-party-advisory vendor-advisory
- github.com issue-tracking release-notes third-party-advisory
- jvn.jp issue-tracking third-party-advisory vdb-entry
- github.com exploit
- github.com
- github.com product