CVE-2024-4323 (tracing http monitoring api) does NOT impact aws-for-fluent-bit
Opened this issue · 5 comments
Describe the question/issue
A memory corruption vulnerability was found in Fluent Bit versions 2.0.7 thru 3.0.3.
Since it seems like version 1.9.10 is being used based on this changelog, there might be no possibility of being affected. However, will aws-for-fluent-bit be impacted by this vulnerability?
Correct. As far as we know there is no impact to AWS for Fluent Bit. #826 (comment)
Configuration
Fluent Bit Log Output
Fluent Bit Version Info
Cluster Details
Application Details
Steps to reproduce issue
Related Issues
AFAIK, this is correct. AWS for Fluent Bit uses 1.9.10 and is not impacted. The CVE was introduced when they introduced tracing support, and our distro has not released that feature yet.
Hi @PettitWesley ,
Thank you for your reply. Your response has resolved my concerns. I will now close this issue.
Best regards,
Keeping this open for a little while in case others have the same question
@PettitWesley we are using stable version of aws-for-fluent-bit
public.ecr.aws/aws-observability/aws-for-fluent-bit:stable
I saw an article related to this which says
"The latest version of Fluent Bit, version 3.0.4, fixes this issue. We'd like to make sure you're aware of a security vulnerability (known as CVE-2024-4323) that impacts Fluent Bit versions 2.0. 7 through 3.0"
We are thinking to upgrade this now to 3.0.4 image, will this be resolving the issue ?
Would the image be impacted in the future when FluentBit version that it uses internally will be bumped? Or the impacted versions will be skipped?