We use cookies to improve your experience on our site.
AVID-2026-R1125
Description
Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration) (CVE-2022-39379)
Details
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable FLUENT_OJ_OPTION_MODE is explicitly set to object. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use FLUENT_OJ_OPTION_MODE=object.
Reason for inclusion in AVID: CVE-2022-39379 describes a remote code execution vulnerability in Fluentd via insecure deserialization when a non-default configuration (FLUENT_OJ_OPTION_MODE=object) is used. Fluentd is a data/logging component commonly used in data pipelines and AI workflows to ingest, process, and transport data for ML models and deployments. Therefore, this vulnerability affects a software component that can be part of the AI software stack (data/feature pipelines, logging/telemetry, deployment pipelines). It is a CVE-style security vulnerability (RCE via deserialization) with clear exploitation conditions and affected versions, and there is evidence of patched versions. This satisfies the criteria for an AI-relevant supply-chain vulnerability in general-purpose AI systems.
References
- NVD entry
- https://github.com/fluent/fluentd/security/advisories/GHSA-fppq-mj76-fpj2
- https://github.com/fluent/fluentd/commit/48e5b85dab1b6d4c273090d538fc11b3f2fd8135
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYD5QV66OLDHES6IKVYYM3Y3YID3VVCO/
Affected or Relevant Artifacts
- Developer: fluent
- Deployer: fluent
- Artifact Details:
| Type | Name |
|---|---|
| System | fluentd |
Impact
AVID Taxonomy Categorization
- Risk domains: Security
- SEP subcategories: S0100: Software Vulnerability
- Lifecycle stages: L06: Deployment
CVSS
| Version | 3.1 |
| Vector String | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
| Base Score | 3.1 |
| Base Severity | 🟢 Low |
| Attack Vector | NETWORK |
| Attack Complexity | 🔴 High |
| Privileges Required | 🟢 Low |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | 🟢 Low |
| Integrity Impact | NONE |
| Availability Impact | NONE |
CWE
| ID | Description |
|---|---|
| CWE-502 | CWE-502: Deserialization of Untrusted Data |
Other information
- Report Type: Advisory
- Credits:
- Date Reported: 2022-11-02
- Version: 0.3.3
- AVID Entry